4 ms·

OAuth sucks. It's one of the worst abstractions of our time. It's incredibly easy to implement some half assed spaghetti and call it "standard OAuth".

• lloydatkinson 3y ago
  I suspect it’s either by design that it is this terrible and hard to deal with or larger auth companies have a vested interest in keeping it this terrible.
  • haswell 3y ago
    There is no grand conspiracy here, and the problems OAuth is trying to solve can be pretty messy regardless of the approach. When the environment involves delegating authentication across service providers, dealing with browsers and native clients, mobile apps, etc, there will not be a simple solution. This is made even more challenging by constantly evolving application and edge deployment architectures, each bringing with it a new element of complexity. OAuth sucks, and I’m sure it could be replaced with something better, but that replacement will also suck and bear a passing resemblance to OAuth, because the underlying problem is a messy one that isn’t going away soon.
• zmxz 3y ago
  It doesn't suck, it's literally bare-minimum what you need in order to securely retrieve the token. It's by far not THE worst, you're spouting total nonsense. What's THE worst is lack of attention, and one needs quite literally 10 minutes to read the RFC and understand it's fairly simple protocol with minimal number of parameters. I'm sorry you had a hard time with OAuth, but have you ever thought the problem is in you and not the protocol? Reason I'm asking is because you declare it sucks but you are not providing any kind of alternative of how it would not suck.
  • hyperpape 3y ago
    > and one needs quite literally 10 minutes to read the RFC rfc 6749 is 4259 words according to wc -l. You mean that it takes 10 minutes to carelessly skim it. Never mind that there are several other OAuth RFCs.
    • zmxz 3y ago
      You need 10 minutes of focused reading to understand what the purpose of the protocol is and you don't need all of the OAuth RFCs to implement the bare-minimum nor do you have to support all the grants available. Most people I worked with don't understand the purpose of OAuth and that's what the 10 minutes should be invested into. Or, you can, you know - nitpick and live in the world of gloom and doom where everything sucks.
      • haswell 3y ago
        For what it’s worth, I taught a series of classes/labs intended to help developers within my former employer’s ecosystem understand OAuth. What I learned after delivering the content to hundreds of devs over the years: OAuth confuses people, and for completely understandable reasons. Most people think about auth in terms of usernames/passwords or API keys. The mental models associated with these do not transfer to OAuth, and there are enough moving parts with client and server-side interactions that someone not already steeped in the authn/authz space will have some catching up to do. Forming an understanding of the basic concepts rarely happens in 10 minutes, and if that’s your experience, good on you. Most of us bang our head against the wall for a bit and some of us go on to teach classes about it. Bottom line: OAuth is hard. That is not the same thing as the general concept being simple.
        • dwaite 3y ago
          > Most people think about auth in terms of usernames/passwords or API keys. OAuth is hard to explain here because it is not an authentication protocol, and without extensions has severe security flaws in being one. OpenID Connect is the most popular effort extending OAuth to also handle authentication. But that doesn't change that the thing OAuth is most associated with is not what it actually sets out to accomplish.
• awill88 3y ago
  An abstraction that allows a landscape of experimentation and learning on an interrupt based general purpose machine? What a bunch of thoughtless assholes!