deep dive into the oauth RFCs this morning ☕

[django@social.coop]

deep dive into the oauth RFCs this morning ☕

#c2s

[django@social.coop]

I found and filed a bug in Pleroma Dynamic Client Registration code

https://git.pleroma.social/pleroma/pleroma/-/issues/3390

[django@social.coop]

Hacked away at C2S authorization in Fedbox with @mariusor 💪

[django@social.coop]

and just discovered @evan lovely oauth decision tree diagram

https://github.com/swicg/activitypub-api/issues/1#issuecomment-3708524521

[evan@cosocial.ca]

@django the part I'm not sure of is the protected resource metadata. I think that's what you use to use SaaS authorization like Okta or Auth0, or if you use a separate server like Keycloak. So, it doesn't assume that the API server is the authorization server.