Post #1888306
2026-05-02 16:36 UTC
Replies (14)
-
@bsuto@macaw.social 2026-05-02 17:12
@paul@tapbots.social flashbacks to spending full days reviewing xAuth requests at Twitter
-
@chockenberry@mastodon.social 2026-05-02 17:08
@paul@tapbots.social Tell me you’re working on Bluesky without telling me you’re working on Bluesky.
-
@sladewatkins@mastodon.social 2026-05-02 23:12
@paul@tapbots.social getting the vibe this is about Phoenix lol
-
@onyxraven@hachyderm.io 2026-05-02 16:42
@paul big corps got involved early to jam their existing requirements into it, diluting the decisions that could have made it more straightforward
-
@waynedixon@mastodon.social 2026-05-02 17:00
@paul I have to maintain/customize one that is used by a large number of end point apps, all with slightly different requirements that aren’t part of the spec. I get the intent but it’s a lot to maintain.
-
@pborenstein@mastodon.social 2026-05-02 17:03
@paul I've done the OAuth API doc three times for three different companies. They all interpreted and implemented the "spec" with slight differences. Tons of fun.
-
@MahdiBM@mastodon.social 2026-05-02 17:05
@paul Long ago I wrote https://github.com/MahdiBM/OAuthBM and bumped into the exact same thing. Every provider does it slightly differently. (Wouldn't actually recommend using the library, it's unmaintained, other than my questionable API design decisions back then)
-
@jrychter@mastodon.social 2026-05-02 17:06
@paul That's why I implemented OAuth myself (yes, myself, not vibe-coded). The intersection of OAuth with an app is just too large of a surface: I looked at several libraries, didn't like them, and didn't see a way to design a nice library API. OAuth is weaved into an application, not attached to it.
-
@czichon@mastodon.social 2026-05-02 17:35
@paul I’m calling for a “OAuth 3” for years…
-
@bbech@mastodon.social 2026-05-02 20:25
@paul having a job where all we do is integrate with third party APIs and with OAuth in front I’m always dumbfounded that 6 years in we are still finding new flavors of OAuth.
-
@Mutesplash@uncontrollablegas.com 2026-05-02 23:19
@paul Pretty sure they made it like this because every service _wanted_ to muck with it to make it not compatible but easy enough to fork.
-
@garthk@eigenmagic.net 2026-05-03 00:55
@paul I know, right? Neither did Eran Hammer, so he walked. Good on him. https://gist.github.com/nckroy/dd2d4dfc86f7d13045ad715377b6a48f
-
@vitor@hachyderm.io 2026-05-03 09:18
@paul Once, on a forum, a user who used to be a regular and generally made unreasonable requests without any real thought or understanding (but seemed to think very highly of themselves) was making yet another nonsensical request, this time involving OAuth. I and another technical user were, for the umpteenth time, trying to explain why their request didn’t make sense in general, that it wouldn’t be workable in this context, and explained a bit of how OAuth works and how terrible it is, to drive the point home. They responded they were aware of how OAuth works, since they were part of the original team. My immediate thoughts, which I kept for myself, were: 1. That explains a lot. 2. Why would you ever brag about that?
-
@mackuba@martianbase.net 2026-05-03 12:22
@paul https://martianbase.net/@mackuba/116507403787274714