[suggestion] OAuth? about ircv3-specifications HOT 13 CLOSED

AIUI, OAuth is horrible to implement if you want to support anything other than web applications for clients.

However, if your heart is set on it, there's already a spec for SASL over IRC, so you could define a SASL mechanism for OAuth and implement that.

from ircv3-specifications.

Agreed that if you want to use it, then it should be a SASL mechanism. Perhaps even reuse Google's XOAUTH2...

from ircv3-specifications.

@docwhat Are you willing to work on this in the future?

from ircv3-specifications.

I've never written specs before. What's involved?

from ircv3-specifications.

@docwhat Implementing it would help, too.

from ircv3-specifications.

Yeah...you don't want me writing C++. I learned way back in '92… it was a broken language then.

from ircv3-specifications.

The IETF's kitten WG is developing A set of SASL Mechanisms for OAuth - this could be a useful starting point.

from ircv3-specifications.

IRC software can be imlemented in other language too, not only C++...

from ircv3-specifications.

I think before anyone seriously considers pulling this in, they should consider the usability aspects of how this would integrate into the IRC client.

Would this be targeted at all clients or just web clients which can hide the details, etc. It seems non-intuitive to me for example, that you would open your browser and do the OAuth dance and then manually configure weechat or whatever to use them, when we already have SASL EXTERNAL. Then there is the matter of integrating it into the authentication layer of the network, who/what would issue the authoritative tokens, for example.

To me the only major beneficiary of this scheme would be web clients, feel free to correct me if I misunderstood.

from ircv3-specifications.

It could work with graphical desktop clients as well (e.g. embedded WebKitGTK or MSHTML for the auth dialog, or redirect-to-localhost, both methods already in use by various Twitter &c. clients).

from ircv3-specifications.

Please don't encourage such broken things. IRC already has authentication methods which are less painful than that.

from ircv3-specifications.

IRC already has authentication methods that are less painful than that.

Especially since for non-web apps OAuth is pretty much a convoluted way of directing the user to the "issue a per-app password" screen.

from ircv3-specifications.

Closing due to lack of support and implementation consideration.

from ircv3-specifications.