Using OAuth2 for solving first party sign in is such a pain. Synchronizing refresh token requests, storing sessions on top of your access token, going through a consent grant, making sure you use the right flow (implicit is out? auth code? with pkce? without?)
There is some really good open source software emerging like https://github.com/ory/kratos which has APIs for native app flows, single page apps, server side apps and doesn‘t rely on protocols intended for completely different things such as „allow CircleCI access to my Gitlab repositories“.
Is it really worth investing in OAuth2 these days just because Auth0 pours millions in marketing? I highly question it…
But seriously, what's going on with all the service disruptions? From slack to all of facebook to GitHub (who had 7 incidents in September). Maybe centralizing the whole internet into a few providers isn't a good idea after all?
There is some really good open source software emerging like https://github.com/ory/kratos which has APIs for native app flows, single page apps, server side apps and doesn‘t rely on protocols intended for completely different things such as „allow CircleCI access to my Gitlab repositories“.
Is it really worth investing in OAuth2 these days just because Auth0 pours millions in marketing? I highly question it…