BT

OAuth Gaining Momentum

by Charles Humble on Jun 10, 2008 |
In a recent blog post Jeff Altwood of Coding Horror fame described an increasingly common, but highly undesirable, practice amongst web site developers; that of asking for your email user name and password so that the service can look through your email contacts to see if any of your contacts also use the service. Jeff illustrates this using Yelp, but he could just as well have used LinkedIn (see below) or any number of other web sites.
LinkedIn - Build your network

 

In typically forthright style, Jeff goes on to highlight why this is such a problem. In short “they have effectively asked for the keys to my house in order to riffle through my address book.”

A number of companies and individuals are working on solutions to this problem including Google, Yahoo and Microsoft, as well as the OAuth project. Initiated by Blaine Cook, Chris Messina, Larry Halff and David Recordon, OAuth aims to provide an open standard for API access delegation. The OAuth discussion group was founded in April 2007 to provide a mechanism for this small group of implementers to write the draft proposal for the protocol. During development significant contributions were received from Eran Hammer-Lahav and Google's DeWitt Clinton. The version 1.0 specification was formally released on December 4th 2007.

At a high level OAuth works as follows:

  1. Your site has established a relationship with various webmail service providers.
  2. You share a pass-phrase, or a public key, that you can use to gain access to the web contacts.
  3. You re-direct the user to the login page for their webmail service provider.
  4. The user signs in and tells the webmail service provider that is OK for your site to access their address book.

OAuth is already gaining considerable momentum, with implementations for many popular languages including Java, C#, Objective-C, Perl, PHP and Ruby. The majority of these implementations are hosted by the OAuth project via a Google Code repository. Ryan Heaton has implemented OAuth for Spring security which can be found here. Sites supporting OAuth include Twitter, Ma.gnolia and Google (Alpha launch post here).

Hello stranger!

You need to Register an InfoQ account or to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread
Community comments

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Discuss

Educational Content

General Feedback
Bugs
Advertising
Editorial
InfoQ.com and all content copyright © 2006-2013 C4Media Inc. InfoQ.com hosted at Contegix, the best ISP we've ever worked with.
Privacy policy
BT