Hello! This is a discussion thread for the proposed FEP-61cf: The OpenWebAuth Protocol. Please use this thread to discuss the proposed FEP and any potential problems or improvements that can be addressed. Summary OpenWebAuth is the “single sign-on” mechanism used by Hubzilla, (streams) and other related projects. It allows a browser-based user to log in to services across the Fediverse using a single identity. Once logged in, they can be recognised by other OpenWebAuth-compatible services, ...

This is the proposed FEP-61cf: The OpenWebAuth Protocol. OpenWebAuth is the “single sign-on” mechanism used by Hubzilla, (streams) and other related projects. It allows a browser-based user to log in to services across the Fediverse using a single identity. Once logged in, they can be recognised by other OpenWebAuth-compatible services, …

  • Ananace@lemmy.ananace.dev
    5·
    9 months ago

    This looks really odd in relation to other fediverse software; Why /magic and required to be on the root of the domain? Why hard-require routing the domain part of the user ID when .well-known/webfinger exists? Why is there a X-Open-Web-Auth header which the spec only describes as “its purpose is unclear from the code”?
    So many questions.

    I definitely like the idea of distributed sign-in, Solid did a decent work of that many years ago after all. This particular proposal just looks rather odd.

    • 0x1C3B00DA@kbin.socialOP
      2·
      9 months ago

      The author wrote this FEP by reverse engineering the Hubzilla implementation. The point of proposing it is to find and answer questions like these.

    • Ademir@lemmy.eco.br
      2·
      9 months ago

      I agree, and .well-known/webfinger is already largely adopted, we should build upon what we already have, not creating even more standards.

      • 0x1C3B00DA@kbin.socialOP
        4·
        9 months ago

        OpenWebAuth has been in use on the fediverse since before WebFinger became so widely used.

        Like I said in a previous comment, this FEP was written by reverse engineering the existing implementation. It’s still a proposal so it still has to go through a discussion period where issues like this can be worked out and it can be updated