Aaron Parecki, an identity and OAuth specialist, writes about OAuth, IndieAuth, MCP authorization, and the IndieWeb.
HN links it for OAuth explanations and the MCP authorization posts; commenters also point to his site as an example of short-form posting.
> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect.
Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at it from a secure protocol design perspective it is riddled with accidental complexity producing unnecessary footguns.
The main culprit is the idea to transfer security critical data over URLs. IIUC this was done to reduce state on the involved servers, but that advantage has completely vanished, if you follow today's best practices to use the PKCE, state and nonce parameter (together with the authorization code flow). And more than half of the attacks you need to prevent or mitigate with the modern extensions to the original OAuth concepts are possible because grabbing data from URLs is so easy: An attacker can trick you to use a malicious redirect URL? Lock down the possible redirects with an explicitly managed URL allow-list. URLs can be cached and later accessed by malicious parties? Don't transmit the main secret (bearer token) via URL parameters, but instead transmit an authorization code which you can exchange (exactly) once for the real bearer token. A malicious app can register your URL schema in your smartphone OS? Add PKCE via server-side state to…
> Most people understand these two things to be, collectively, the "provider" side of OAuth
Citation needed. As another commenter already noted, the term "Provider" is rarely used in OAuth itself. When it is mentioned, it's typically in the context of OpenID Connect, where it refers specifically to the Authorization Server - not the Resource Server.
> the service provider, who is providing an API that requires authorization
That’s actually the Resource Server.
I understand that the current MCP spec [1] merges the Authorization Server and Resource Server roles, similar to what your library does. However, there are strong reasons to keep these roles separate [2].
In fact, the MCP spec authors acknowledge this [3], and the latest draft [4] makes implementing an Authorization Server optional for MCP services.
That’s why I’m being particular about clearly naming the roles your library supports in the OAuth flow. Going forward, MCP servers will always act as OAuth Resource Servers, but will only optionally act as Authorization Servers. Your library should make that distinction explicit.
[1]: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization
[2]: https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protocol
[3]: https://github.com/modelcontextprotocol/modelcontextprotocol/issues/205
[4]: https://modelcontextprotocol.io/specification/draft/basic/authorization
RSS is pull only. It probably serves 80% of needs for most people ("I want to know when so-and-so has new content without manually going to the site") but ActivityPub does a bit more:
- pushes content to subscribers in real-time (doable with RSS with WebSub https://en.wikipedia.org/wiki/WebSub)
- allows content to "swim back" to the publisher: comments, replies, retweets/boost (doable with WebMentions https://www.w3.org/TR/2017/REC-webmention-20170112/)
- defines a protocol for posting to an AP-enabled endpoint (doable with micropub)
AP defines a lot of things but doesn't do it well (see https://schub.wtf/blog/2019/01/13/activitypub-final-thoughts-one-year-later.html), because it is not strict enough in what constitutes valid content. There are alternatives, listed above, that already do the work but they are centered towards everyone having their own server and going from site to site to post comments; the real appeal of AP solutions is that they're an all-in-one blob you connect to, and from which you do your browsing. The indieweb people (responsible for the alternatives above) have come up with "social readers" to enable this and have made a few propositions already: see https://indieweb.org/social_reader (https://aaronparecki.com/2018/03/12/17/building-an-indieweb-reader in particular)
This is fantastic. I've implemented OAuth2 4-5 times over the past few years. It seams overly complicated at first, but over time I've come to understand more of the vulnerabilities each piece of complexity exists to mitigate. Every time I've thought I could do it simpler, I eventually discovered a vulnerability in my approach. You get basically all that knowledge here in a concise blog post. This is going to be the first thing I link anyone to if they're interested in learning OAuth.
One gripe from Attack #3[0]:
> The solution is to require Pied Piper to register all possible redirect URIs first. Then, Hooli should refuse to redirect to any other domain.
There's actually a another (better IMO) solution to this problem, though to date it's rarely used. Instead of requiring client registration, you can simply let clients provide their own client_id, with the caveat that it has to be a URI, and a strict prefix of the redirect_uri. Then you can show it to the user so they know exactly where the token is being sent, but you also cut out a huge chunk of complexity from your system. I learned about it here[1].
[0]: https://stack-auth.com/blog/oauth-from-first-principles#attack-3
[1]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web
For browserless, I was referring to a 2019 article that I could have sworn was newer than that, on the need for OAuth 2.1 that also covers how they added OAuth for Native Apps (Code Flow) and basically a QR code version for TVs: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
As for SFAuthenticationSession, again my info might be outdated, but the basic idea is that there are often native APIs that can load OAuth requests in a way that doesn’t require you to relogin. Honestly most of those use cases have been deprecated by PassKeys at an operating system level. There’s (almost) no need for a special browser with cookies to your favourite authenticated services if you have PassKeys to make logging in more painless.
Yeah, I read this and thought "makes total sense that Okta would be one of the prime movers behind this". The more I think about it, the more this is just like an app dashboard that an employee can use to access many different apps and that the enterprise can use to control and monitor access. So it makes total sense that they solved this (very real) problem.
I like one of the author's characterizations[0].
> Now employees no longer have to connect MCP servers manually and wait for a series of OAuth and login prompts. Once you log in to Claude from Okta, all the preconfigured MCP servers are already connected! It's not every day you get to improve both usability and security!
0: https://aaronparecki.com/2026/06/18/12/claude