3 ms·

Centralized services gonna centralize. Something I've been thinking about recently is that a full web browser is a hard dependency of OAuth2-based systems. Tha

Centralized services gonna centralize. Something I've been thinking about recently is that a full web browser is a hard dependency of OAuth2-based systems. That's 20-30 million lines of code even for the simplest systems, even though you're basically just using the browser as a form renderer and a central space to store tokens. I feel like there's room for a simpler protocol designed to operate on HTTP plus a minimal UI language (maybe JSON-based) used to describe forms for granting access. This would make it much easier to develop for devices that don't have browsers. You could even make CLI interfaces for authorization flows.

mooreds 6y ago
You might want to check out GNAP. I did an overview of it here: https://fusionauth.io/blog/2021/01/07/gnap-next-gen-oauth/ https://fusionauth.io/blog/2021/01/07/gnap-next-gen-oauth/ but you can also check out the spec here: https://datatracker.ietf.org/doc/draft-ietf-gnap-core-protocol/ https://datatracker.ietf.org/doc/draft-ietf-gnap-core-protoc... They are aware of the issues of the browser centricity of OAuth. It's definitely not the simpler protocol you describe, but it's one way to look at the future.