WeChat ID
aaronpk_tv
-
-
-
Aaron Ogle
https://fosstodon.org/@geekgonecrazy
•
Oct 26
@aaronpk is pkce used very often? When I was initially implementing pkce in a few cli tools I didn’t see a lot of people talking about it. Most people I talk to are familiar with oauth but you mention pkce and they don’t know it
CLI tools are a bit of a special case, but if you're using the auth code flow with a CLI client, then you should also definitely use PKCE. -
Aaron Ogle
https://fosstodon.org/@geekgonecrazy
•
Oct 26
@aaronpk is pkce used very often? When I was initially implementing pkce in a few cli tools I didn’t see a lot of people talking about it. Most people I talk to are familiar with oauth but you mention pkce and they don’t know it
It's used pretty often, but apparently not as often as it should. There's no excuse for not using it these days, that's why it's not called PKCE in OAuth 2.1, it's just built in to the authorization code flow. -
Aaron Parecki
https://aaronparecki.com/
•
Oct 26
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
tl;dr: Don't accept access tokens in your redirect URI (don't use the implicit flow)
PKCE solves this attack and is enforced by the server rather than relying on client developers to "verify the access token" as described in the post -
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
-
These are really great! I like what you've done here!
-
@shanselman@hachyderm.io thanks for the invitation! Chatting about #POSSE and #IndieWeb techniques in general sounds like fun — let’s do it
-
-
The deadline to submit drafts ahead of the IETF meeting in November just passed, and I submitted my last one with 30 minutes to spare! Here are all the docs I'll be discussing:
https://www.ietf.org/archive/id/draft-ietf-oauth-browser-based-apps-15.html
https://www.ietf.org/archive/id/draft-ietf-oauth-resource-metadata-01.html
https://www.ietf.org/archive/id/draft-parecki-oauth-first-party-apps-00.html
https://www.ietf.org/archive/id/draft-parecki-oauth-metadata-for-nested-flows-00.html -
