The most popular and comprehensive Open Source ECM platform
Let us know more
Security: Building the Successor to OAuth
OAuth is an open standard for authorization that enables clients to access applications via a secure token over https rather than with login credentials. OAuth 2.0 is the current and most frequently used version.
OAuth 1.0a, the previous version, was considered complex and challenging to implement. In effect, OAuth 2.0 dumbs down the original version, although it is less secure.
Eran Hammer-Lahav, original lead for the OAuth 2.0 specification, said in 2012 that “when compared with OAuth 1.0, the 2.0 specification is more complex, less interoperable, less useful, more incomplete, and most importantly, less secure. I resigned my role as lead author and editor, withdrew my name from the specification, and left the working group…Deciding to move on from an effort I have led for over five years was agonizing.”
In order to address some of the problems with OAuth 2.0, there have been a number of add-on specifications via RFCs and BCPs created to plug some of the problems with the original OAuth 2.0 specification.
Now there’s work on a revised version of OAuth. It’s not being called OAuth 3.0, instead it is being called Grant Negotiation and Authorization Protocol (GNAP). One big change proposed for GNAP is to be able to use JSON instead of HTTP parameters and the idea of redirects. New security changes are also proposed.
The GNAP working group is targeting completion of the specification in 2022.
