> the OAuth protocol itself is indeed correctly designed and is secure by nature. However, to use it with a web service requires integrating it into that servic

> the OAuth protocol itself is indeed correctly designed and is secure by nature. However, to use it with a web service requires integrating it into that service’s existing platform, which is where the trouble starts That's my main beef with OAuth. I like having a standard in the middle, I also like OAuth, and I think I understand some of the flows well (I have enough knowledge to know I'm not an expert). The main issue is that it is complex enough that you can botch the implementation in multiple places (eg misuse of the refresg_token), flexible enough that you can take the wrong shortcuts (eg use the wrong flow), and most implementations have semi-transparent intermediary points (eg Jwt that you can see into) that make you feel like you understand the whole thing while you only get half of it - or once again use a component for something it should not be used (id_token for authorization being the most common). It's better than inventing your own scheme, which is certain to fail. But most people don't spend or don't get the time they need to understand properly. It doesn't result in gaps necessarily, but it can.