3 ms·
What's the general take on OAuth vs WebAuthn?
by camkego 5y ago
What's the general take on OAuth vs WebAuthn?
- postalrat 5y agoWhy not both?
- jiveturkey 5y agothey are orthogonal
- dwaite 5y agoOAuth is typically used to delegate authorization, e.g. let some site or CLI read your GitHub repos. To be able to delegate authorization in this scenario, you're first going to have to prove who you are to GitHub. Thats where you'd use WebAuthn. They basically solve separate problems. Now, when you are doing OpenID Connect (which adds Authentication), this becomes more of a question like - do I have users sign in with their Github account to my site, or do I just support all that directly via WebAuthn. Quite a bit more overlap. * However, its not that uncommon for sites to support multiple ways to log in. Having a cloud-based login and a local login might prevent some random event causing the user to completely lose the ability to log in. * Note I took some license here, since Github built their own thing rather than using OpenID Connect.