According to blog posts like A Flood of Mashups Coming? OAuth 1.0 Released and John Musser’s OAuth Spec 1.0 = More Personal Mashups? , it looks like the OAuth specification has reached it’s final draft.
This is good news because the need for a standardized mechanism for users to give applications permission to access their data or act on their behalf has been obvious for a while. The most obvious manifestation of this are all the applications that ask for your username and password so they can retrieve your contact list from your email service provider.
So what exactly is wrong with applications like the one’s shown below?
The problem with these applications [which OAuth solves] is that when I give them my username and password, I’m not only giving them access to my address book but also access to
because all of those services use the same credentials. Sounds scary when put in those terms doesn’t it?
OAuth allows a service provider (like Google or Yahoo!) to expose an interface that allows their users to give applications permission to access their data while not exposing their login credentials to these applications. As I’ve mentioned in the past, this standardizes the kind of user-centric API model that is utilized by Web services such as the Windows Live Contacts API, Google AuthSub and the Flickr API to authenticate and authorize applications to access a user’s data.
The usage flow end users can expect from OAuth enabled applications is as follows.
1. The application or Web site informs the user that it is about to direct the user to the service provider’s Web site to grant it permission.
2. The user is then directed to the service providers Web site with a special URL that contains information about the requesting application. The user is prompted to login to the service provider’s Website to verify their identity.
3. The user grants the application permission.
4. The application gets access to the user’s data and the user never had to hand over their username and password to some random application which they might not trust.
I’ve read the final draft of the OAuth 1.0 spec and it seems to have done away with some of the worrisome complexity I’d seen in earlier draft (i.e. single use and multi-use tokens). Great work by all those involved.
I never had time to participate in this effort but it looks like I wouldn’t have had anything to add. I can’t wait to see this begin to get deployed across the Web.
Now playing: Black Eyed Peas - Where is the Love (feat. Justin Timberlake)