[HN Gopher] What's OAuth2, Anyway?
       ___________________________________________________________________
        
       What's OAuth2, Anyway?
        
       Author : roma_glushko
       Score  : 38 points
       Date   : 2025-01-26 10:15 UTC (2 days ago)
        
 (HTM) web link (www.romaglushko.com)
 (TXT) w3m dump (www.romaglushko.com)
        
       | vivzkestrel wrote:
       | very comprehensive but i wanted to add. oauth is one of those
       | things i read about and forget 6 months later. there has to be a
       | gamified way to make people learn about oauth and enforce it deep
       | inside their brains
        
         | 7bit wrote:
         | As with everything: repetition. If you forget these things you
         | don't use them often enough. On that level, do you really need
         | to remember them or are you happy enough to have a good and
         | short reference, like this article for example?
         | 
         | My personal answer is: a cheat sheet is enough.
        
         | taurath wrote:
         | If you implement it twice, the sequence diagram tends to get
         | burned into the brain. It's tricky and you'll be able to
         | anticipate its trickiness.
        
       | 7bit wrote:
       | This is an excellent article. The only thing I am missing is a
       | short paragraph about OIDC, which is the thing that enables
       | authentication. To most people who just get in touch with the
       | topic OAuth is more authentication than authorization.
        
       | yencabulator wrote:
       | > Apart from that, OAuth2 is such a vast area that we have been
       | able to only answer the fundamental why questions and review the
       | most popular delegation grants in this article.
       | 
       | So, what we've learned is that OAuth2 is not a single thing, and
       | that it is too complex.
        
         | lxgr wrote:
         | That matches my experience, and it doesn't help that the RFCs,
         | in trying to explain it, have declared defeat early on.
        
           | mdhb wrote:
           | The oauth 2.1 spec does a lot to bring everything together
           | and simplify things at the same time.
        
         | 7bit wrote:
         | OAuth is authorization only. The part where it is vast is the
         | different mechanics to grant/delegate access. And that's really
         | needed because you need to be able to have Oauth working fo
         | humans and machines where the accessing service can be the app
         | on your phone, or some backend server.
        
       ___________________________________________________________________
       (page generated 2025-01-28 23:00 UTC)