Your SlideShare is downloading. ×
0
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
OAuth you said
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

OAuth you said

8,437

Published on

OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. It specifies a process for resource …

OAuth is an open standard for authorization. OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. It specifies a process for resource owners to authorize third-party access to their server resources without sharing their credentials but it became a big mess.

Published in: Technology
0 Comments
113 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
8,437
On Slideshare
0
From Embeds
0
Number of Embeds
10
Actions
Shares
0
Downloads
53
Comments
0
Likes
113
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. OAuth.io OAUTH YOU SAID?
  • 2. Why OAuth? Provide a standard way to access protected resources, without sharing passwords. OAuth.io OAuth, You said?
  • 3. OAuth.io AMAZING! BUT HOW? OAuth, You said?
  • 4. OAuth.io The middle-man between the service and the OAuth provider ! Never share your Facebook credentials with a service. ! Today, almost any app needing access or permissions relies on OAuth. OAuth, You said? Tokens!
  • 5. OAuth.io Users had to provide their Facebook credentials to third party services. ! Not secure. Intrusive. Inconvenient. OAuth, You said? Before? Basic Auth.
  • 6. OAuth was first designed to be interoperable and super easy to implement for developers. Started as a Protocol OAuth.io OAuth, You said?
  • 7. OAuth 2.0 has been reclassified as a framework. Which means no interoperability and no backward compatibility :/ Ended up as a Framework OAuth.io OAuth, You said?
  • 8. 30+ different implementations ! Two separate flows for token retrieval. ! Resources' names and parameters differ from one provider to another ! A nightmare for developers: lots of potential traps. No hope for a good learning curve… So yes, OAuth is broken OAuth.io OAuth, You said?
  • 9. OAuth 1.0 = October 2007 OAuth 1.0a = June 2009 OAuth 2.0 first draft = early 2010
 OAuth 2.0 final = late 2011 Many versions in 5 years OAuth.io OAuth, You said?
  • 10. Complex signature scheme. ! Almost no control over token expiry. ! No permission management. OAuth.io OAuth, You said? OAuth 1.0a was limited
  • 11. ! More flexible but less interoperable SSL rather than signatures Easier to implement No backward compatibility OAuth.io OAuth, You said? OAuth 2.0 compromise
  • 12. Resource Owner: the user who wants to share a resource, e.g. owner of the facebook photos. ! Client: the application that wants to leverage a resource hosted by a third party, e.g. the photo printing website. ! Authorization Server: the entity that decides to grant access to the client (application), e.g. Facebook’s authorization server. ! Resource Server: the place where the third party resource is hosted, e.g. Facebook’s server where the photos to print are. 4 quick definitions
  • 13. The Flow
  • 14. Further reading https://tools.ietf.org/html/rfc6749 http://tools.ietf.org/html/rfc5849 OAuth 1.0 Specs OAuth 2.0 Specs Fuck OAuth by Eran Hammer talk http://vimeo.com/52882780 OAuth.io OAuth, You said? Read our full OAuth Tutorial
  • 15. Credits The Big Lebowski Walker Texas Ranger aka Chuck (the 1st) Norris Jackie Brown 2001: A Space Odyssey R2D2: Star Wars (Dagobah) C3PO: Star Wars (Tatooine) Las Vegas Parano Terminator Forrest Gump Austin Powers OAuth.io OAuth, You said? Judge Dredd

×