The Modern Guide to OAuth
Cool to see such a comprehensive guide! At the same time, are people seriously still pushing OAuth2 for first party auth? Shouldn’t everyone know by one that OAuth does not solve:<p>* registration
* account recovery
* profile management
* 2fa
* …<p>and is generally completely overblown for first party auth? I always to cite from the abstract of the OAuth2 RFC:<p>> The OAuth 2.0 authorization framework enables a *third-party*
   application to obtain limited access to an HTTP service<p>Yet somehow all of these proprietary software companies (FusionAuth, Auth0, …) cling to the only „open protocol“ to push „portability“ of protocols. But the problem of portability is really a problem of data (you user’s data and migrating that data from system A to B), not the way you exchange or validate tokens or cookies.<p>I think it’s exciting to see new open source projects like <a href="https://github.com/ory/kratos" rel="nofollow">https://github.com/ory/kratos</a> or <a href="https://github.com/supertokens/supertokens-core" rel="nofollow">https://github.com/supertokens/supertokens-core</a> that finally break up this misconception!