5 ms·

Love this post by Nango, it's exactly right! Agreed that the biggest reason is that OAuth is a framework and not a protocol. That means different companies can

by cco 3y ago

Love this post by Nango, it's exactly right! Agreed that the biggest reason is that OAuth is a framework and not a protocol. That means different companies can do it ever so slightly differently, and as a dev, you need to understand the differences and normalize it for your use case. At Stytch we've run into the same issues, normalization problems, security implications, flaky IdPs; a hard problem, but one you _have_ to get right!

dwaite 3y ago
> OAuth is a framework and not a protocol Indeed, a lot of people do not realize the difference. Frameworks do not provide interoperability, and at most we can push to try to get people to solve problems the same way. Profiles (such as OpenID Connect or FAPI) constrain frameworks allowing implementations to be interoperable. OAuth is somewhat like the multitude of different dialects in some places like the United Kingdom. The original article was talking about the problems due to trying to support all those different OAuth dialects. I'd argue most developers will never know that degree of pain, because they are only trying to solve problems within their particular application space.