A guide to Oauth2
I'm currently in the middle of implementing an OAuth 2.0 authorization server following the RFC draft of the best current practice [1].<p>It's been a huge pain navigating all the interlinked (and sometimes contradicting) RFCs around, especially with a distinct lack of resources for actually <i>implementing</i> an authorization server. RFC6749 does not suffice on its own since it says nothing about authentication or tokens payload (not that it should). I did discover the whole RFC universe which are mostly fascinating and very well written.<p>Most google searches end up to Auth0 (nice SEO!), which I'm sure is a fine product, but usually only gives a very high-level overview of the corresponding spec and ends up like "see how this is all complicated? there's a SAAS for that...".<p>I'm seriously considering implementing a fully spec-compliant OAuth 2.0 + OpenID Connect Core 1.0 reference server implementation in Typescript, with full documentation quoted straight from the RFCs. The HOW is actually pretty straight-forward once you've figured out the WHAT and WHY.<p>[1] <a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics" rel="nofollow">https://tools.ietf.org/html/draft-ietf-oauth-security-topics</a>