4 ms·
I have read many docs. The one that I find easiest to understanding is still the one that I wrote about a decade ago when I first had to work with OAuth 2. Al
by btilly 4y ago
I have read many docs.
The one that I find easiest to understanding is still the one that I wrote about a decade ago when I first had to work with OAuth 2. All others I understanding by mapping what they said to concepts in mine, and that seems to work pretty well.
My document is available at https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Authen/OAuth2/Overview.pod https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Aut.... Even though you're unlikely to ever use that library or language, you may find it worthwhile.
- sebmellen 4y agoI'm pretty astounded, because this is by far the best OAuth 2 doc I've ever read, and that's after reading and watching many hours of content from leaders and companies in the space.
- btilly 4y agoThank you. It summarized my understanding after a month of reading documentation, doing experiments, and generally banging my head against the wall.
- mixmastamyk 4y agoLooks great, taking a look and favoriting. (Only feedback I can think of is that it would be great to have a few diagrams... like from excalidraw or something. Am largely a visual learner.)
- interroboink 4y agoAs a fan of Perl, this situation of having an obscure, meticulously-documented CPAN module to not only explain but implement some common-but-surprisingly-hard pattern is just so ... Perl-y (: Perhaps it's a semi-consequence of Perl being perceived as old and crusty, and popular with old crusty people who are merely trying to get things done without fluff (at least speaking for myself). Reminds me of Data::Manip, another favorite of mine. Thanks for taking the time to write this (and implement all that nonsense).
- btilly 4y agoThanks. The crustiness in this case was enhanced by my grumpiness over some frustrating debugging sessions, and having to go through a lot of very confusing documentation to get there. That grumpiness shows through in a couple of places. For example I understand why Google decided that I was asking for the same permission too often, and began handing me codes that would not work. And also wouldn't explain what was wrong with the code that I just got.
- count 4y agoPlease publish this on its own somewhere! This is fantastic.
- adammarples 4y agoI'm bookmarking this to go through the next time I need to bang my head against this wall, thanks
- jkubicek 4y agoYour documentation is amongst the best I've seen on OAuth, but it suffers from the same naming confusion I always run into when I'm reading OAuth docs. > OAuth 2 makes it easy for large service providers to write many APIs that users can securely authorize third party consumers If I'm trying to write a Mastodon client, I'm reading this line piece by piece: > OAuth 2 makes it easy for large service providers "service providers" OK, that must be the Mastodon service. > ... to write many APIs that users "users" That must be me > ... can securely authorize third party consumers "consumers" OK... that's also me?
- Operyl 4y agoUsers are your users shared with the users of that API service (which may include you if you use your own service), consumer in this case is you (the application you're running).
- btilly 4y agoThat is why there is a terminology section: https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Authen/OAuth2/Overview.pod#Terminology https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Aut... If you're trying to write a Mastadon client, then the Mastadon service is the service provider, you are the consumer, and the people who wish to use your client are the users.
- mekoka 4y agoI think it's helpful to not stray too far away from the standard terminology. I found that "third party" was an excellent indicator that the consumer is probably not me, especially since I've already qualified as a user.
- pcthrowaway 4y agoRead the introduction again, and then follow the link to the Terminology section.
- pcthrowaway 4y agoThis is the first Oauth document I've seen with a no-nonsense "Terminology" section. Thank you! The only thing I'd suggest is putting the terminology first, so readers can first correct their misconceptions from all the terrible literature around this.
- btilly 4y agoI thought about it, and settled on the compromise of referring to it up front, and then putting it at the end. That's because there are many ways you could use a document like that. And the Terminology section is very overwhelming unless your goal is to understand how OAuth 2 REALLY works, and why it works that way.