4 ms·

Is this about OAuth or OAuth2? Despite their similar names, the two systems have almost nothing in common and the headline should be clear. Edit: Clicked and i

Is this about OAuth or OAuth2? Despite their similar names, the two systems have almost nothing in common and the headline should be clear. Edit: Clicked and it's about OAuth2, but also OpenIDConnect (an extension to OAuth2, but actually a distinct protocol) > From a pentesting point of view, whenever you test an OAuth application, there is a good chance that the target server also supports OpenID Again playing very loose with the terminology. OpenID (no "Connect") is yet another completely unrelated protocol.

HeapsGood 6y ago
Eh, not so much. I don’t think many people have mentioned “OAuth” in quite a while without implicitly meaning OAuth2. Same with OpenID and OIDC. Precision is great, but some assumed terminology will happen in forums that frequent the terms.
UncleMeat 6y ago
Terminology is always loose. We still use "SSL" when we want to say "TLS". When we say "HTTP" we definitely aren't speaking about "HTTP 1.0". In most contexts, "OAuth" means some combination of "OAuth2 and OpenID Connect".