OAuth 2.0 Security Best Current Practice
I implemented more than a dozen OAuth integrations last year with multiple American and Chinese companies and oh boy it was painful.<p>I do not know why so many engineers end up reading a clear specification document like RFC-6749 [1] and then ignore 80% of the instructions. I had to deal with so many weird bugs and bad OAuth server implementations, I lost count of how many emails went back and forth trying to make sense of unexpected behavior.<p>Even Apple engineers got it wrong. They decided to create their own thing based on OpenID Connect for “Sign In With Apple” [2]. OpenID had to write an open letter [3] explaining the repercussions of their changes and fortunately were able to convince Apple to fix the implementation [4].<p>OpenID was lucky though, they had some leverage, but a <i>no-one</i> like me couldn’t possibly convince a gigantic conglomerate like Tencent to fix their web API. Talking with Tencent engineers has been one of the worst experiences in my career. The company apparently has a culture of constant job rotations, engineers are assigned projects for short periods of time with bonuses for early completion which encourage them to deploy half-finished code before moving to something else.<p>[1] <a href="https://tools.ietf.org/html/rfc6749" rel="nofollow">https://tools.ietf.org/html/rfc6749</a><p>[2] <a href="https://developer.apple.com/sign-in-with-apple/" rel="nofollow">https://developer.apple.com/sign-in-with-apple/</a><p>[3] <a href="https://openid.net/2019/06/27/open-letter-from-the-openid-foundation-to-apple-regarding-sign-in-with-apple/" rel="nofollow">https://openid.net/2019/06/27/open-letter-from-the-openid-fo...</a><p>[4] <a href="https://openid.net/2019/09/30/apple-successfully-implements-openid-connect-with-sign-in-with-apple/" rel="nofollow">https://openid.net/2019/09/30/apple-successfully-implements-...</a>