3 ms·
My rant about OAuth: It is overly complex because it has too many features to satisfy each and every enterprise case. For me who runs a simple website (no 3rd
by littlecranky67 4y ago
My rant about OAuth: It is overly complex because it has too many features to satisfy each and every enterprise case.
For me who runs a simple website (no 3rd party login), I learned that OAuth2 is just not a good choice. JWE/JWT and samesite=strict plus HttpOnly cookies are reasonably simple, yet secure enough.
- chasd00 4y agoA simple website with no third party login nor needing access to a third party API on behalf of the user should never use Oauth to begin with. a standard session cookie works just fine in those situations (as you discovered).