Item — HN Reader

I always felt that implementing OAuth authorization was much too complicated. I used to think it was because I'm an idiot, but seeing so many people have trouble with the same thing makes me doubt myself.

I've used Mozilla Persona and THAT was straightforward. I can't help but feel that Person is what OAuth should have been. Secure, simple login for my grandmother, and easy to implement and integrate for Joe Coder.

3 comments

If you decide not to support the HMAC stuff, writing a server implementation for OAuth 2.0 isn't really that bad. Something I've been confused about since day one is the need for refresh token. If an attacker is able to sniff the auth token, wouldn't they be able to sniff the refresh token, too?

My understanding, and it may be wrong, is that if an attack walks off with your data, then wouldn't be able to refresh the access token you have on hand without the client ID and secret and so the extent to which they could compromise the authorized accounts is limited in time.

What's worse is when OAuth providers force the refresh tokens to be refreshed! Many OAuth providers are now requiring user-action (ie. re-walk through the oauth popup) every x months to get new refresh tokens.

As a user I am actually okay with this. That way if I haven't visited a website in a long time, then most likely they should no longer have access to my account.

Maybe I've long moved on and forgotten about that one site that I authorised and now they are using my data in a way that I wouldn't approve of.

The tricky part is for services like IFTTT (where I used to work) and Zapier (where the GP works) where you do want an authorization to be indefinite and not require user interaction because it's a background job.

I've been wondering this as well. Maybe it protects against replay attacks? They're certainly a bit frustrating.

OAuth 1.0a is far too complex. OAuth 2.0 for the simple and common cases is not that bad since there's no signature to generate.

Most of the issues from OAuth 2 stem from a fluid spec that wasn't finalized until recently. Now that that's done hopefully the situation will stabilize and once you learn how to use one (I also recommend making the requests directly yourself and not using a library) you'll easily be able to use all the others without having to search out all the quirks I wrote about in this post.

I felt the same way until I started writing the HTTP requests myself.

This was one situation where using a library really slowed me down and hurt my understanding of what was going on.