News for hackers. Stuff that matters.

A comment on Run your own OAuth2 server.

Re:Run your own OAuth2 server by ourcat on Monday September 04, 2017 @10:02AM (#15168260)
Worth adding to this that Wordpress have been working on an official OAuth1.0a server plugin for while alongside the development of the new REST API. It works well. I've built an iOS app on the back of it. (1.0a was chosen due to WP not wanting to enforce https.) https://en-gb.wordpress.org/plugins/rest-api-oauth1/

I've also seen discussion on an official OAuth2 server plugin, what with the rapid increase of https sites, thanks to the likes of LetsEncrypt.

There's a well supported OAuth2.0 server plugin here: https://en-gb.wordpress.org/plugins/oauth2-provider/

But you'd be wise to only run it via https.

[ Parent | on HN ]
Re:Run your own OAuth2 server by machete143 on Monday September 04, 2017 @10:06AM (#15168277)
Yes indeed, running OAuth2 without https is madness!
[ Parent | on HN ]
Re:Run your own OAuth2 server by unilynx on Monday September 04, 2017 @12:42PM (#15169311)
It's not just madness, TLS is a MUST in several places in the oauth2 spec.

In fact, they managed to remove a lot of oauth1 madness (all the complex signing stuff) by simply requiring TLS and let that layer deal with it.

[ Parent | on HN ]