<story><title>OAuth Security Cheatsheet</title><url>http://www.oauthsecurity.com/</url></story><parent_chain></parent_chain><comment><author>stormbrew</author><text>The place I work for deals with about 20 different site&amp;#x27;s oauth processes and it&amp;#x27;s amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don&amp;#x27;t, some of them still need you to send a login&amp;#x2F;password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them &lt;i&gt;require&lt;/i&gt; that the token be passed as a query string parameter instead of as a header for all requests. Being responsibly secure with all of them is quite difficult. It doesn&amp;#x27;t help that it&amp;#x27;s very difficult to have a development environment work properly with them, so doing active work against them is often painful.&lt;p&gt;OAuth is basically a complete mess, implementation-wise, and that&amp;#x27;s really sad since it&amp;#x27;s such a promising and useful premise.</text></comment>
<story><title>OAuth Security Cheatsheet</title><url>http://www.oauthsecurity.com/</url></story><parent_chain></parent_chain><comment><author>homakov</author><text>It&amp;#x27;s using free plan on heroku, so if it will be down repo is available at &lt;a href=&quot;https://github.com/homakov/oauthsecurity&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;homakov&amp;#x2F;oauthsecurity&lt;/a&gt;</text></comment>