3 ms·
OAuth has always been quite hard to grasp, even though I use it every day. One day I'll write an implementation to properly understand how it works from the bot
by chrysoprace 8mo ago
OAuth has always been quite hard to grasp, even though I use it every day. One day I'll write an implementation to properly understand how it works from the bottom up and go through each of the standards that have evolved over time.
- KPGv2 8mo agoI did this for OAuth and OAuth2 in Unison. It was a headache to be sure I did everything procedurally correct. The hash token is based off using certain KVPs from a dictionary of various bits of data, and you sort it in a certain order before hashing, and certain steps require certain bits of data, and sometimes it's URL encoded and sometimes it's not, and all of this dramatically changes the hash. I remember how stoked I was to finally get it working. It was a massive pain, but luckily there were websites that would walk through the process procedurally, showing how everything worked, one step at a time.
- chrysoprace 8mo agoAny that you would recommend? I've found a couple of guides but they've all been quite light on details or a very basic implementation.
- tndata 8mo agoI wrote one extensive guide "OpenID Connect for Developers" at https://tn-data.se/openid-connect/ https://tn-data.se/openid-connect/
- brabel 8mo agoWhat do you mean by hash token?? Are you referring to PKCE (which is an extension to OAuth)?