Elektrine lite

← Feed

@paul@tapbots.social

Post #1888306

2026-05-02 16:36 UTC

I think I'm on my 5th different OAuth implementation throughout the years. They keep getting more and more convoluted. I don't really get the point of a specification when its so broad and complex that every service that implements it does it in a way that makes it incompatible with any other service.

Replies (14)

  • @bsuto@macaw.social 2026-05-02 17:12

    @paul@tapbots.social flashbacks to spending full days reviewing xAuth requests at Twitter

    Open ##1888305

  • @paul@tapbots.social Tell me you’re working on Bluesky without telling me you’re working on Bluesky.

    Open ##1888807

  • @paul@tapbots.social getting the vibe this is about Phoenix lol

    Open ##1897065

  • @onyxraven@hachyderm.io 2026-05-02 16:42

    @paul big corps got involved early to jam their existing requirements into it, diluting the decisions that could have made it more straightforward

    Open ##1932489

  • @waynedixon@mastodon.social 2026-05-02 17:00

    @paul I have to maintain/customize one that is used by a large number of end point apps, all with slightly different requirements that aren’t part of the spec. I get the intent but it’s a lot to maintain.

    Open ##1932490

  • @pborenstein@mastodon.social 2026-05-02 17:03

    @paul I've done the OAuth API doc three times for three different companies. They all interpreted and implemented the "spec" with slight differences. Tons of fun.

    Open ##1932491

  • @MahdiBM@mastodon.social 2026-05-02 17:05

    @paul Long ago I wrote https://github.com/MahdiBM/OAuthBM and bumped into the exact same thing. Every provider does it slightly differently. (Wouldn't actually recommend using the library, it's unmaintained, other than my questionable API design decisions back then)

    Open ##1932493

  • @jrychter@mastodon.social 2026-05-02 17:06

    @paul That's why I implemented OAuth myself (yes, myself, not vibe-coded). The intersection of OAuth with an app is just too large of a surface: I looked at several libraries, didn't like them, and didn't see a way to design a nice library API. OAuth is weaved into an application, not attached to it.

    Open ##1932494

  • @czichon@mastodon.social 2026-05-02 17:35

    @paul I’m calling for a “OAuth 3” for years…

    Open ##1932499

  • @bbech@mastodon.social 2026-05-02 20:25

    @paul having a job where all we do is integrate with third party APIs and with OAuth in front I’m always dumbfounded that 6 years in we are still finding new flavors of OAuth.

    Open ##1932500

  • @paul Pretty sure they made it like this because every service _wanted_ to muck with it to make it not compatible but easy enough to fork.

    Open ##1932503

  • @garthk@eigenmagic.net 2026-05-03 00:55

    @paul I know, right? Neither did Eran Hammer, so he walked. Good on him. https://gist.github.com/nckroy/dd2d4dfc86f7d13045ad715377b6a48f

    Open ##1932505

  • @vitor@hachyderm.io 2026-05-03 09:18

    @paul Once, on a forum, a user who used to be a regular and generally made unreasonable requests without any real thought or understanding (but seemed to think very highly of themselves) was making yet another nonsensical request, this time involving OAuth. I and another technical user were, for the umpteenth time, trying to explain why their request didn’t make sense in general, that it wouldn’t be workable in this context, and explained a bit of how OAuth works and how terrible it is, to drive the point home. They responded they were aware of how OAuth works, since they were part of the original team. My immediate thoughts, which I kept for myself, were: 1. That explains a lot. 2. Why would you ever brag about that?

    Open ##1932508

  • @mackuba@martianbase.net 2026-05-03 12:22

    @paul https://martianbase.net/@mackuba/116507403787274714

    Open ##1932509