WeChat ID
aaronpk_tv
-
at The UncannyPortland, Oregon • Sat, October 28, 2023 7:11pm
-
Cocktail
-
Spooky Margarita
-
Vegan Mussaman Curry
-
at The ReddPortland, Oregon • Sat, October 28, 2023 4:23pmVegan Night Market — with anomalily
-
Portland, Oregon • Sat, October 28, 2023 12:43pm
-
AsleepAwake7h 13mSlept20mAwake for
-
178.6lbsWeight24.8%Body Fat -
AsleepAwake8h 02mSlept59mAwake for
-
-
Ride
1.25miDistance6:53DurationStartEnd
-
-
Aaron Ogle
https://fosstodon.org/@geekgonecrazy
•
Oct 26
@aaronpk is pkce used very often? When I was initially implementing pkce in a few cli tools I didn’t see a lot of people talking about it. Most people I talk to are familiar with oauth but you mention pkce and they don’t know it
CLI tools are a bit of a special case, but if you're using the auth code flow with a CLI client, then you should also definitely use PKCE. -
Aaron Ogle
https://fosstodon.org/@geekgonecrazy
•
Oct 26
@aaronpk is pkce used very often? When I was initially implementing pkce in a few cli tools I didn’t see a lot of people talking about it. Most people I talk to are familiar with oauth but you mention pkce and they don’t know it
It's used pretty often, but apparently not as often as it should. There's no excuse for not using it these days, that's why it's not called PKCE in OAuth 2.1, it's just built in to the authorization code flow. -
Aaron Parecki
https://aaronparecki.com/
•
Oct 26
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
tl;dr: Don't accept access tokens in your redirect URI (don't use the implicit flow)
PKCE solves this attack and is enforced by the server rather than relying on client developers to "verify the access token" as described in the post -
This is a good writeup on some sneaky vulnerabilities in OAuth implementations, but ultimately is just a simple access token injection attack: https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
-
AsleepAwake8h 29mSlept22mAwake for
-
Nachos
-
These are really great! I like what you've done here!
