Dear OAuth providers
pilcrowonpaper.com
  • AnarchistArtificer@slrpnk.netEnglish
    35·
    10 days ago

    “This isn’t about being spec-compliant anymore. I need to know the thought process behind this decision. And also please fix it.”

    This unhinged tone is what I live for in blog posts

    Edit: added hyperbole to make humourous intent clearer

  • BatmanAoD@programming.dev
    171·
    10 days ago

    The spec requires errors to be a single string, and also mandates using the space character as a separator? I’m not a fan of deviating from spec, but those are…bad choices in the spec.

    • chaospatterns@lemmy.worldOPEnglish
      201·
      10 days ago

      The spec mandating its as a single string isn’t that crazy. It’s good to have a consistent response format so a basic deserializer can deserialize any error response object and get something out.

      If you have different providers. One that returns error: { code: string } and another does something else, you end up with the same problem this post talks about-- Inconsistency.

      As far as I can tell, the spec doesn’t limit you to just the one field and you can add other optional fields to the top level to the response that the caller can optionally decide to handle. But if you know there’s going to be a field called error that is a string. You always get at least something out of that to present.

      • BatmanAoD@programming.dev
        4·
        9 days ago

        Yeah, consistency is good, which is why it’s good to follow the spec. I’m saying that the decision to make errors be flat strings in the spec was a bad one. A better design would be what you have, where code is nested one level below error, plus permitting extra implementation-defined fields in that object.

  • chaospatterns@lemmy.worldOPEnglish
    14·
    10 days ago

    It just goes to show the small parts of API design matter just as much as the big parts. I’ve worked with a lot of engineers who are so eager to draw big boxes and arrow architectural diagrams, but then just rush the details because that’s not important.

    • WanakaTree@lemm.ee
      15·
      10 days ago

      A big part of my job is API integrations. The most infuriating one I deal with is a startup who keeps adding new properties with property names randomly being pascal case, camel case, or snake case. Especially when the same property is one case on a request model and different on the response.

  • Blackmist@feddit.ukEnglish
    9·
    9 days ago

    Having dealt with a few it seems nobody really cares about specs and just implements something that returns a token.

    The result is you end up doing a load of work every single time and none of that can be used for anyone else’s implementation.

    I get the idea of oauth, but the implementations needed a whole lot less wiggle room, because it turns out when you’re a massive corporation every other poor bastard just has to adapt to your nonsense.

    • mesamune@lemmy.worldEnglish
      2·
      6 days ago

      Same. Ive had to create a couple of custom API wrappers and each one is significantly different especially with oauth. But it almost always comes down to getting a temp token, do a thing for a time, get another temp token, so on so forth.