3 ms·
According to the page at https://developers.google.com/accounts/docs/OpenID#shutdown-timetable https://developers.google.com/accounts/docs/OpenID#shutdown-...,
by NeutronBoy 12y ago
According to the page at https://developers.google.com/accounts/docs/OpenID#shutdown-timetable https://developers.google.com/accounts/docs/OpenID#shutdown-..., the first user-visible warnings appeared in November 2014 (unless disabled by the site operator). 6 months is not an unreasonable timeline to make some minor adjustments to your auth system to make it OpenID Connect compatible (from a quick glance at the migration page, it basically required adjusting the auth URL and adding a few extra params).
- jontro 12y agoI don't know if you can call it a minor adjustment. More like implementing a new method, like adding facebook connect. It's a completely different api, also you have to register an app on cloud.google.com. At least they still provide backwards compatible tokens.
- vertex-four 12y agoOpenID Connect is an entirely separate protocol from OpenID 2.0. Essentially, it's an extension of OAuth2, which is difficult to implement correctly on your own. Libraries are available for most languages for it, though.
- abraham 12y agoOAuth 2 is not difficult to implement as a consumer.
- Legogris 12y agoHave you read the specs? Getting it "working" is trivial, but to guarantee security there are a lot of considerations and checks you must or should do that are easily overlooked.
- abraham 12y agoPretty much all of the security considerations are factors for the provider and not the consumer. Consumers should use validated TLS and encrypted storage, but beyond that consumers have more to worry about keeping their own application secure.