BT

New Early adopter or innovator? InfoQ has been working on some new features for you. Learn more

OAuth Gaining Momentum

| by Charles Humble Follow 16 Followers on Jun 10, 2008. Estimated reading time: 1 minute |
In a recent blog post Jeff Altwood of Coding Horror fame described an increasingly common, but highly undesirable, practice amongst web site developers; that of asking for your email user name and password so that the service can look through your email contacts to see if any of your contacts also use the service. Jeff illustrates this using Yelp, but he could just as well have used LinkedIn (see below) or any number of other web sites.
LinkedIn - Build your network

 

In typically forthright style, Jeff goes on to highlight why this is such a problem. In short “they have effectively asked for the keys to my house in order to riffle through my address book.”

A number of companies and individuals are working on solutions to this problem including Google, Yahoo and Microsoft, as well as the OAuth project. Initiated by Blaine Cook, Chris Messina, Larry Halff and David Recordon, OAuth aims to provide an open standard for API access delegation. The OAuth discussion group was founded in April 2007 to provide a mechanism for this small group of implementers to write the draft proposal for the protocol. During development significant contributions were received from Eran Hammer-Lahav and Google's DeWitt Clinton. The version 1.0 specification was formally released on December 4th 2007.

At a high level OAuth works as follows:

  1. Your site has established a relationship with various webmail service providers.
  2. You share a pass-phrase, or a public key, that you can use to gain access to the web contacts.
  3. You re-direct the user to the login page for their webmail service provider.
  4. The user signs in and tells the webmail service provider that is OK for your site to access their address book.

OAuth is already gaining considerable momentum, with implementations for many popular languages including Java, C#, Objective-C, Perl, PHP and Ruby. The majority of these implementations are hosted by the OAuth project via a Google Code repository. Ryan Heaton has implemented OAuth for Spring security which can be found here. Sites supporting OAuth include Twitter, Ma.gnolia and Google (Alpha launch post here).

Rate this Article

Adoption Stage
Style

Hello stranger!

You need to Register an InfoQ account or or login to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread
Community comments

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Discuss

Login to InfoQ to interact with what matters most to you.


Recover your password...

Follow

Follow your favorite topics and editors

Quick overview of most important highlights in the industry and on the site.

Like

More signal, less noise

Build your own feed by choosing topics you want to read about and editors you want to hear from.

Notifications

Stay up-to-date

Set up your notifications and don't miss out on content that matters to you

BT