4 ms·
OIDC describes itself as: "OpenID Connect is an interoperable authentication protocol based on the OAuth 2.0 framework". So Oauth2/OIDC is what you typically w
by eterm 2y ago
OIDC describes itself as: "OpenID Connect is an interoperable authentication protocol based on the OAuth 2.0 framework".
So Oauth2/OIDC is what you typically want?
I don't really understand the details well. I understand what vendors and customers are after. I wouldn't ever try to write any clients/servers myself for this stuff.
- zwnow 2y agoWhy though? Why are devs so afraid of auth?
- eterm 2y agoI'm not afraid, I just don't understand the nuances well enough. But it's also easy to understand what there is to be scared about: 1. Security critical. 2. Single source of failure. ( If your auth fails, it doesn't just break one feature or aspect, it takes everything and everyone down with it. ) 3. Performance critical. It's a bottleneck in most applications, it's very rare and even more difficult to get distributed auth working, if you factor in repudiation / token cancellation. It's not an area you can "fake it 'til you make it" or "move fast and break things" with. Even just "buying" the solution isn't easy. Actually implementing your own OIDC client/server solution is a large project that only makes sense to dedicate a team to in the largest of organisations.
- zwnow 2y agoSo how are hobbyists handling auth in their hobby projects? I am sure they cant commit to using OIDC if its that difficult to implement? This is something I try to understand since almost 2 years... Are they just using jwts?