News for hackers. Stuff that matters.

A comment on Run your own OAuth2 server. Parent comment

Re:Run your own OAuth2 server by homakov on Monday September 04, 2017 @03:42PM (#15170413)
Not just that, a couple of other bad decisions that caused made many websites inherently insecure https://sakurity.com/oauth
[ Parent | on HN ]
Re:Run your own OAuth2 server by machete143 on Monday September 04, 2017 @05:11PM (#15170883)
That is a really bad specification with no examples, no formalization, and zero references.

However, all server-side attack scenarios listed there are not possible with Hydra. Some of them also boil down to misusing OAuth2 for authentication, which is why we have OpenID Connect.

[ Parent | on HN ]
Re:Run your own OAuth2 server by homakov on Monday September 04, 2017 @06:44PM (#15171292)
No, ignore the spec (it's just a list of traits i'd like to suggest), design issues are outlined after it.
[ Parent | on HN ]
Re:Run your own OAuth2 server by ForHackernews on Monday September 04, 2017 @03:46PM (#15170433)
At a glance, this looks like a proprietary re-invention of of https://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-...
[ Parent | on HN ]