# OAuth done right

**URL:** <https://discuss.coding.social/t/oauth-done-right/518>\
**Category:** SX solution development\
**Tags:** best-practice\
**Created:** [April 18, 2024, 9:43am UTC](https://discuss.coding.social/t/oauth-done-right/518 "2024-04-18T09:43:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryuno-Ki](https://discuss.coding.social/user_avatar/discuss.coding.social/ryuno-ki/32/44_2.png) [@Ryuno-Ki](https://discuss.coding.social/u/Ryuno-Ki)\
**Post date:** [April 18, 2024, 9:43am UTC](https://discuss.coding.social/t/oauth-done-right/518/1 "2024-04-18T09:43:33Z")

</div>

The other day, I observed someone asking in GoToSocial chat rooms whether a list of open sessions could be found somewhere. From the social experience, this is granting another client app access to your instance (timeline, DMs etc).

Those are authorised using the OAuth flow.

From a security point of view, it is recommended to have a short-lived initial token that grants the permission (if the person did) and hands over so called refresh tokens that extend the session. These can live longer because they’re easier to revoke.

It also makes sense to expose a list of running sessions with the option to terminate them.

Mastodon is apparently only serving the initial token with quasi infinitive lifetime according to one of the GtS developers. I haven’t confirmed myself yet.

Even if GtS is adapting the best practices, client apps will break because they are likely not prepared to handle the proper flow.

I wonder what could be done to get this right, given that there is an evergrowing list of ActivePub applications and everyone orients on Mastodon.

---

<div class="post-metadata">

**Author:** ![wojciechxtx](https://discuss.coding.social/user_avatar/discuss.coding.social/wojciechxtx/32/681_2.png) [@wojciechxtx](https://discuss.coding.social/u/wojciechxtx)\
**Post date:** [April 18, 2024, 10:42am UTC](https://discuss.coding.social/t/oauth-done-right/518/2 "2024-04-18T10:42:13Z")

</div>

> [@Ryuno-Ki](#):
>
> get this right

Whats right and whats wrong here? From your post I can deduct that things, as they are now, are wrong. So, whats that you would like to see improved? Be more specific if you can.

Your post looks like being written with SEO in mind only. Just marketing BS nothing more.

---

<div class="post-metadata">

**Author:** ![Ryuno-Ki](https://discuss.coding.social/user_avatar/discuss.coding.social/ryuno-ki/32/44_2.png) [@Ryuno-Ki](https://discuss.coding.social/u/Ryuno-Ki)\
**Post date:** [April 18, 2024, 2:48pm UTC](https://discuss.coding.social/t/oauth-done-right/518/3 "2024-04-18T14:48:23Z")

</div>

First: You could have put this friendlier. Why would I write „with SEO in mind”?

Point taken that I could have linked to a source. But those are easy to find.  
For example, Auth0 has published

> **[Token Best Practices - Auth0 Docs](https://auth0.com/docs/secure/tokens/token-best-practices)**
>
> Lists best practices when using tokens in authentication and authorization.

[OAuth.com](http://OAuth.com) explains why the Best Practice is not popular with developers and what to do about it:

> **[Access Token Lifetime - OAuth 2.0 Simplified](https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/)**
>
> When your service issues access tokens, you'll need to make some decisions as to how long you want the tokens to last. Unfortunately there is no blanket

OWASP has even more tips:

> **[OAuth2 - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html)**
>
> Website with the collection of all the cheat sheets of the project.

I feel a long-written explanation would have missed the point: To think about how to implement OAuth proper instead of a fast solution.

---

<div class="post-metadata">

**Author:** ![wojciechxtx](https://discuss.coding.social/user_avatar/discuss.coding.social/wojciechxtx/32/681_2.png) [@wojciechxtx](https://discuss.coding.social/u/wojciechxtx)\
**Post date:** [April 18, 2024, 6:14pm UTC](https://discuss.coding.social/t/oauth-done-right/518/4 "2024-04-18T18:14:25Z")

</div>

> [@Ryuno-Ki](#):
>
> You could have put this friendlier

I fail to see me being unfriendly here… seriously.

> [@Ryuno-Ki](#):
>
> Why would I write „with SEO in mind”?

To make this post and this forum rank higher in search engines. Thats what SEO is for 🙂