News for hackers. Stuff that matters.

A comment on Show HN: Hydra – Open-Source OAuth2 Server. Parent comment

Re:Show HN: Hydra – Open-Source OAuth2 Server by vwpolo3 on Monday July 01, 2019 @01:40PM (#20327772)
While not explicitly mentioned, PKCE is supported! And yes, that draft was an important guide during implementation.
[ Parent | on HN ]
Re:Show HN: Hydra – Open-Source OAuth2 Server by unscaled on Monday July 01, 2019 @10:01PM (#20331500)
How do you deal with IdP/AS mix-up?

The BCP recommends either sending back client_id and iss (but that draft[1] is long expired, and nobody seems to support that implementation), or asking the client to provider a separate exact-match return URI for each AS. The second solution is what I'm doing when implementing multi-AS/IdP OAuth clients, but this requires the clients to be aware of this vulnerability, and that's a rather tall requirement.

[1] https://tools.ietf.org/html/draft-ietf-oauth-mix-up-mitigati...

[ Parent | on HN ]
Re:Show HN: Hydra – Open-Source OAuth2 Server by webhamster on Tuesday July 02, 2019 @03:28AM (#20332955)
There is no issuer in OAuth. Therefore, the distinct-redirect-URI solution is the most universal.
[ Parent | on HN ]