4 ms·
Been dealing with Microsofts OAuth transition at work, and it's been a bit of a PITA. Part of the problem is that it's just so opaque. You send the token and t
by magicalhippo 3y ago
Been dealing with Microsofts OAuth transition at work, and it's been a bit of a PITA.
Part of the problem is that it's just so opaque. You send the token and the server replies "nope", with no further explanation.
I spent literal days trying to figure out why Client Credentials-flow didn't work until I found an answer buried on their help forum saying oh yeah, client credentials flow isn't supported yet. It is now for IMAP/POP, but still not for SMTP IIRC (though OAuth is not requiredfor SMTP yet).
Next it was figuring out the right scopes, which at the time was not very well documented. Again not very helpful error messages by the servers.
Google's mail servers any better?
- xtajv 3y ago> Part of the problem is that it's just so opaque. You send the token and the server replies "nope", with no further explanation. Catch-all HTTP 401s and 403s are there to thwart https://en.wikipedia.org/wiki/Oracle_attack https://en.wikipedia.org/wiki/Oracle_attack - unfortunately, servers cannot afford to be "helpful" when it comes to unauthenticated clients.
- mmbop 3y agoThey should have a debug mode that is user-activated for stuff like this. I also have burned too many hours trying to get various OAuth flows working.
- magicalhippo 3y agoYeah some development servers that didn't actually send the mail anywhere but did give usable error messages for example would be amazing. To avoid it being used as an attack vector they could be tied to special app registrations that had to be registered with the mail development system in advance.
- datadrivenangel 3y agoMicrosoft is amazingly good at those opaque error messages. Such a mess of UX