News for hackers. Stuff that matters.
Re:Run your own OAuth2 server by machete143 on Monday September 04, 2017 @10:24AM (#15168388)
Good point, Hydra does this to for things like missing TLS encryption but not yet for secrets (it only rejects secrets that are too short). I've tracked this here: https://github.com/ory/hydra/issues/573
Re:Run your own OAuth2 server by hxtk on Monday September 04, 2017 @08:10PM (#15171627)
It seems like the simplest thing, then, would be to use a secret that is too short in your documentation and make note of both the fact that it's too short and what the requirements are for a good secret.

Of course, this runs the risk that a user will simply "salt" the sample you provide up to the necessary length, which makes the length of their secret effectively the difference between the minimum length and the sample length.