3 ms·
I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities. I think less tha
by rockdoe 11y ago
I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities.
I think less than a week ago (weakdh) tptacek was mentioning on twitter that security schemes should be versioned but not extensible exactly due to these kind of errors.
- SFjulie1 11y agoThis was predicted http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/ http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-h... Oauth 2.0 is so much of a flexible framework it almost boils down to "roll your own crypto with very complex tools and a lot of moving parts" I am gonna watch the world burn safely eating my popcorn with my old fashions AAA system (radius, LDAP, ssh..) expecting more vulnerabilities to be uncovered and waiting for employers and architects to require my now valuable knowledge. Mouhahahahahahha