{"id":10533,"date":"2021-02-12T07:00:00","date_gmt":"2021-02-12T15:00:00","guid":{"rendered":"https:\/\/formtek.com\/blog\/?p=10533"},"modified":"2020-11-11T08:58:59","modified_gmt":"2020-11-11T16:58:59","slug":"security-building-the-successor-to-oauth","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/security-building-the-successor-to-oauth\/","title":{"rendered":"Security: Building the Successor to OAuth"},"content":{"rendered":"\n

OAuth is an open standard<\/a> for authorization that enables clients to access applications via a secure token over https rather than with login credentials. OAuth 2.0 is the current and most frequently used version.<\/p>\n\n\n\n

OAuth 1.0a, the previous version, was considered complex and challenging to implement. In effect, OAuth 2.0 dumbs down the original version, although it is less secure.<\/p>\n\n\n\n

Eran Hammer-Lahav<\/a>, original lead for the OAuth 2.0 specification, said in 2012 that<\/a> “when compared with OAuth 1.0, the 2.0 specification is more complex, less interoperable, less useful, more incomplete, and most importantly, less secure. I resigned my role as lead author and editor, withdrew my name from the specification, and left the working group\u2026Deciding to move on from an effort I have led for over five years was agonizing.”<\/p>\n\n\n\n

In order to address some of the problems with OAuth 2.0, there have been a number of add-on specifications via RFCs and BCPs<\/a> created to plug some of the problems with the original OAuth 2.0 specification.<\/p>\n\n\n\n

Now there’s work on a revised version of OAuth. It’s not being called OAuth 3.0, instead it is being called Grant Negotiation and Authorization Protocol <\/a>(GNAP). One big change proposed for GNAP is to be able to use JSON instead of HTTP parameters and the idea of redirects. New security changes are also proposed.<\/p>\n\n\n\n

The GNAP working group is targeting completion of the specification in 2022.<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

OAuth is an open standard for authorization that enables clients to access applications via a secure token over https rather than with login credentials. OAuth 2.0 is the current and most frequently used version. OAuth 1.0a, the previous version, was…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-10533","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/10533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=10533"}],"version-history":[{"count":1,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/10533\/revisions"}],"predecessor-version":[{"id":10534,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/10533\/revisions\/10534"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=10533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=10533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=10533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}