Conversation

#Oauth2 is a mess. As usual when a standard is a mess, it's because it is incomplete, very much like #ActivityPub.

As the number of services grows, the chances of smooth interoperability goes way, way down. In the case of Oauth2, this is because every Oauth2 library, every Oauth2-supporting service, every Oauth2-consuming client has a different idea of how access tokens are to be handed off from provider to client, especially if the client is not another website (e.g. #fedilab).