3 ms·
Then it would no longer be oauth2? Standards exist to prevent deviations. How do you manage signing keys and distribute them? What signature scheme,encoding,etc
by badrabbit 8y ago
Then it would no longer be oauth2? Standards exist to prevent deviations. How do you manage signing keys and distribute them? What signature scheme,encoding,etc... Should be used?
- stedaniels 8y agoPlaying devils advocate. Show me a half decent commercial API that doesn't specify any rules of engagement with their API. All the minutiae would be specified there.
- dwaite 8y agoWhat they are doing is no longer OAuth 1, since they require a hash of the body as a parameter for input into the OAuth 1 signature/MAC.