doorkeeper
Doorkeeper is a OAuth 2 provider library developed for Ruby on Rails and Grape applications. RFC offers authorization flows, token management and security mechanisms in accordance with 6749 standards. It is configured as a Rails engine, providing a variety of ORM support and expandable architecture.
doorkeeper-gem · Authentication & Identity
Common commercial products in this category: Auth0, Okta, AWS Cognito
- You add Ruby on Rails or OAuth 2 provider functionality to your Grape app.
- You manage different OAuth 2 streams, such as authorization code, renewal token, and client credentials.
- You integrate token cancellation into your application of security standards such as insight (introspective) and PKCE.
- ↓ NegativeHacker News
CSRF in Doorkeeper OAuth2 gem
“While I believe that allowing CSRF is terrible practice, as a user of Doorkeeper, I think the problem here is Digital Ocean's atypical usage of OAuth2. When you request an access token for a resource owner in OAuth2, you are supposed _actually authenticate_ the owner. According…”
- • NeutralHacker News
CSRF in Doorkeeper OAuth2 gem
“This is pretty bad, but I believe it is only possible to get an access token if you also allow malicious/non-trusted users to either create new OAuth client registrations (`Doorkeeper::Application` models) or modify the redirect URI of an existing OAuth client registration. The…”