What Is OAuth?

The thing about OAuth is that it’s really very simple. You just have to grasp a lot of very complicated details (that nobody explains) first before it becomes simple.

In case anyone is wondering how to scroll: your mouse needs to be in the center of the page, not in the margins.

I've been meaning to set up some nginx-level oauth. I have some self-hosted apps I want to share with friends / family but forcing them to remember a user / pass (basic auth) or run a vpn is a bit too much friction.

OAuth has always been quite hard to grasp, even though I use it every day. One day I'll write an implementation to properly understand how it works from the bottom up and go through each of the standards that have evolved over time.

The title of the post, which the submitter dutifully copied, is IMHO unfortunate since the post seeks to answer the following question:

What I need is to understand why it is designed this way, and to see concrete examples of use cases that motivate the design

It's not "just another" explanation for how OAuth does, which was my immediate guess when reading the title.

However glad I opted to give it a chance, and likely especially illuminating for the younger crowd who didn't get to experience the joys of the early web 2.0 days.

If you go to most Fortune 500 companies they will have a whole team of people dedicated to running an IdP and doing integrations. Most people on these teams cannot explain oauth, oidc, or saml even though they work with it every single day. It’s that bad.

Pain. Thanks for asking.

It's something many people use, but many of them don't know what it is. Thanks for this article.

Great writeup

[flagged]