2 ms·

For another quick way to get started with OAuth2, I can recommend reading the 2.1 spec draft[1]. For a spec it is quite readable and pretty short. One reason f

For another quick way to get started with OAuth2, I can recommend reading the 2.1 spec draft[1]. For a spec it is quite readable and pretty short. One reason for this is that it "[..] is an in-progress effort to consolidate and simplify the most commonly used features of OAuth 2.0." [2] It does away with most of the complicated grants/flows of previous version and basically boils down to just two[3]: - Authorization Code Grant - Client Credentials Grant Authorization Code Grant (which now implies PKCE) is what you most probably want in most cases. So instead of complicated decision trees[4] for most people it will be: "Learn one grant and be done". [1] https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-05 https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-... [2] https://oauth.net/2.1/ https://oauth.net/2.1/ [3] There is also the Refresh Token Grant, but it cannot be used alone. There is also an extension mechanism to define new grants and we will have to see if it is used. [4] https://alexbilbie.com/images/oauth-grants.svg https://alexbilbie.com/images/oauth-grants.svg

mooreds 5y ago
Author here. Yes, I think that reading the OAuth 2.1 spec is a great place to start. They've taken 10ish years of real world learning and condensed it down. I first wrote about it 2 years ago[0] but have been following along on the email list and they seem to be getting closer and closer. I don't think it is at 'last comment' yet, but I know they've done a lot of work. I am also excited about GNAP, which is a 'from scratch' attempt to solve much the same problem. They've made some great progress[1]. I briefly cover both of those in the article, in the "OAuth's future" section 0: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1 https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1 1: https://justinsecurity.medium.com/the-gnapathon-57ee110508ac https://justinsecurity.medium.com/the-gnapathon-57ee110508ac
9dev 5y ago
Ah, I just found out the Device Authorization Grant didn't make it in there, which is a bit sad - that was a really pragmatic way of building user-friendly authorisation for all kinds of devices where you don't have your password manager available. I even used it to build a CLI authorisation flow once. It seems I have missed quite a bit of development here and will have to catch up, so thank you for the links!

mooreds 5y ago

Author here. Yes, I think that reading the OAuth 2.1 spec is a great place to start. They've taken 10ish years of real world learning and condensed it down. I first wrote about it 2 years ago[0] but have been following along on the email list and they seem to be getting closer and closer. I don't think it is at 'last comment' yet, but I know they've done a lot of work. I am also excited about GNAP, which is a 'from scratch' attempt to solve much the same problem. They've made some great progress[1]. I briefly cover both of those in the article, in the "OAuth's future" section 0: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1 https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1 1: https://justinsecurity.medium.com/the-gnapathon-57ee110508ac https://justinsecurity.medium.com/the-gnapathon-57ee110508ac

9dev 5y ago

Ah, I just found out the Device Authorization Grant didn't make it in there, which is a bit sad - that was a really pragmatic way of building user-friendly authorisation for all kinds of devices where you don't have your password manager available. I even used it to build a CLI authorisation flow once. It seems I have missed quite a bit of development here and will have to catch up, so thank you for the links!