Something about Apple's decision to do "OAuth-but-not-quite" ... • Aaron Parecki

Something about Apple's decision to do "OAuth-but-not-quite" rubbed me the wrong way, but this is a great example of how it breaks down very concretely.

https://twitter.com/atomicbird/status/1163478833326108673

Santa Ana, California, USA

Mon, Aug 19, 2019 2:29pm -07:00 #apple #oauth #openid #oidc

18 likes 9 reposts 6 replies
Have you written a response to this? Let me know the URL:
- beroal CS twitter.com/beroal_cs
  
  IIRC, incompatibilities between implementations sank OpenID. Hence the problem is in the programmers, again.
  
  Fri, Aug 30, 2019 8:06pm +00:00 (via brid-gy.appspot.com)
- Hirsch Singhal twitter.com/hpsin_
  
  (and thank you for your writeup on what the heck is Apple ID, it's been a great resource to help bring others up to speed)
  
  Mon, Aug 19, 2019 11:41pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  Yeah totally. That was why I was bashing my head against the wall for a while when I first tried this API out. I couldn't figure out what I was doing wrong. The worst part is it's based on the first time the user approves the app regardless of whether the app finishes the flow. John P Dandison ☁☁☁
  
  Mon, Aug 19, 2019 10:49pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  100%. Also notice how not following the spec opened up a new vulnerability. But when has Apple been known to respect standards? Hirsch Singhal
  
  Mon, Aug 19, 2019 10:48pm +00:00 (via brid-gy.appspot.com)
- John Patrick Dandison ☁☁☁ twitter.com/AzureAndChill
  
  There’s not a clear way to ‘reset’ either which makes test/dev extremely frustrating Aaron Parecki Aaron Parecki Aaron Parecki
  
  Mon, Aug 19, 2019 10:46pm +00:00 (via brid-gy.appspot.com)
- Hirsch Singhal twitter.com/hpsin_
  
  This is disappointing, and likely a hole in any OIDC compliance. I'd expect requesting an email scope drops the email claim into the token. Aaron Parecki Aaron Parecki Aaron Parecki
  
  Mon, Aug 19, 2019 10:42pm +00:00 (via brid-gy.appspot.com)

Posted in /notes using quill.p3k.io