News for hackers. Stuff that matters.

A comment on Run your own OAuth2 server. Parent comment

Re:Run your own OAuth2 server by machete143 on Monday September 04, 2017 @10:06AM (#15168277)
Yes indeed, running OAuth2 without https is madness!
[ Parent | on HN ]
Re:Run your own OAuth2 server by unilynx on Monday September 04, 2017 @12:42PM (#15169311)
It's not just madness, TLS is a MUST in several places in the oauth2 spec.

In fact, they managed to remove a lot of oauth1 madness (all the complex signing stuff) by simply requiring TLS and let that layer deal with it.

[ Parent | on HN ]