me: ugh why do no oauth guides actually provide worked examples of flows
oauth official web site: "featured: master oauth 2.0 from this guide with modern use cases and real-world examples!"
me: 👀
guide: [ten paragraphs of front matter] you're looking to do a first-party login and registration flow!
me: okay, I already knew that, but maybe this link will lead somewhere useful [clicks]
guide: this guide does not cover first-party login and registration flows!
me: ...
guide: however: keep these two things in mind!
me: okay...
guide: 1) first-party login and registration flows should be handled by an OAuth server.
me: are you fucking kidding me
Bingle bongle :3
- she/her
Pansexual transfem | mid-20s | neurodivergent tech nerd | Picrew: https://picrew.me/share?cd=fwSwR9108J | My wonderful amazing fiancé @icannotgetoverbirds :3
You must log in to comment.
in reply to @vogon's post:
I work in IAM if you have questions. Can't speak to all softwares, but can give general answers.
thanks for the offer! I might take you up on it, but for the time being I was able to find the answer to my main question on https://aaronparecki.com/oauth-2-simplified/ (i.e., what types of grants should be used for different types of applications)
Well if Aaron Parecki's stuff leads you to his employer's software (Okta), I'll just say that is the suite I'm most familiar with.
this is because oauth is actually a fucking sham
it's all just spicy basic auth if tls is out of the picture
hahaha yup, I had to figure out some OAuth/OIDC stuff for work recently and ended up just reading the standards documents because nothing else would actually explain anything I wanted to know (:
When docs are written
by people who know how it works
for other people who know how it works
with no idea how to write
for people who don't know
.