WeChat ID
aaronpk_tv
-
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Arguably, tho, PKCE and putting a client secret into a SPA are orthogonal. It's conflating two things that work differently. Poor devs can't understand those differences.
The error should be "we see you sent a client secret and an Origin header. is your client a SPA?"
I totally agree, this error message makes no sense. I'm going to file a ticket tomorrow internally to fix it. -
Hirsch Singhal
https://twitter.com/hpsin_
•
Feb 25
Helps prevent devs from putting their client secrets in a web page to perform the client creds flow, yep. When AAD enabled this, we definitely got a couple support calls on that. This was how we ratcheted forward PKCE use from suggested to required as well.
yep you guessed it! misleading error message but that's exactly what was going on. -
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Ah, good question -- I didn't notice that. I bet their client config is misconfigured then.
Yep, I confirmed my suspicion. Misleading error message. Will post details on the github thread.
-
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
People are asking, when using standards compliant OIDC client libraries:
https://github.com/authts/oidc-client-ts/issues/395#issue-1149525542
why does that example have the browser sending a client secret in the request? That seems odd. Happy to continue this over on the github thread. -
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
It's confusing as hell, and I'm confused by the implementation -- on the token endpoint if Origin is present, you require that the authz used PKCE? That's about the only valid approach to that I can imagine.
Yeah that's right. I agree it's super confusing and has caused some tricky issues before. It may be different in the new platform but I'd have to double check
-
Brock Allen
https://twitter.com/BrockLAllen
•
Feb 25
Hey @aaronpk, can you explain this help article? It makes no sense to me. TIA
https://support.okta.com/help/s/article/Browser-requests-to-the-token-endpoint-must-use-Proof-Key-for-Code-Exchange?language=en_US
Oh yeah, I remember this one. I don't remember if this is still current behavior, but basically Okta is tying to prevent browsers from using anything other than the authorization code PKCE flow. It does that by detecting the Origin header which isn't sent by server apps. -
Aaron Parecki
https://aaronparecki.com/
•
Feb 23
Do I know anyone involved with @LoginDotGov? I found a few (minor) issues with the OAuth/OpenID docs there https://developers.login.gov/oidc/
I didn't realize before, but their docs are open source! I just sent them a PR to fix it!
https://github.com/18F/identity-dev-docs/pull/235 -
Jason Garber
https://twitter.com/jgarber
•
Feb 23
18F manages the app. Main source repo is here: https://github.com/18F/identity-idp
Not sure if the docs are generated from there, though.
oh awesome, their docs are on there! I will just send them a PR then!
https://github.com/18F/identity-dev-docs -
Do I know anyone involved with @LoginDotGov? I found a few (minor) issues with the OAuth/OpenID docs there https://developers.login.gov/oidc/
-
It's here! The new PK1 cage for the YoloBox!
This cage is the mobile complement to the desktop version of the stand.
Get yours from @aaronpk_tv and @inux3d
link: https://pk1.tv/pk1-yolobox-cage/
#pk1stand #streamingrig #mobilestreaming #yolobox #livestreaming
-
In my free time, I’m learning how to use a Uni steno hobbyist keyboard ($100) with @plover (free). Open steno is REALLY cool! ❤️@StenoKeyboards #opensteno #plover #stenographer #stenonerd
-
Run don’t walk, and watch @mondobytes’ #LumixGH6 video. This is stellar. https://youtu.be/vCDUUHV_mvE
