Matthieu 🦋

Yep

This is actually a "feature". Since PDS can host HTML Blobs (and thus JS), I wanted to prevent XSS attacks. I think we could reasonably make this configurable though, and allowlist some uris (checked against the referer)

We just relaxed restrictions around redirect uris 😜

atproto/packages/oauth/oauth-client-browser-example at main · bluesky-social/atproto Social networking technology created by Bluesky. Contribute to bluesky-social/atproto development by creating an account on GitHub.

Here is an example implementation. See main.tsx to build a client ID for local dev. Then use
client=await BrowerOAuthClient.load({clientId,allowHttp:true})
Then client.init() if that does not return a value use .restore()

I wish atproto 's reference implementation was built using hapijs !

I guess that's what OAuth 2.1 is for

Two types of OAuth client are supported by atproto: "public" and "confidential"

This new article digs in to the security trade-offs and safety mechanisms at play, and how they impact different app architectures: TMBs, BFFs, SPAs, etc

Thank YOU!

Yep, exactly

Large scale apps wouldn't want to bind every single sessions to a single value (nonce) as this could cause a lot of un-happy users when that value changes. The recommendation is to maintain multiple keys (e.g. one per version of the app) so that only problematic sessions can be revoked.

Yep, a client could totally do that! But you can still have more than 1. The app could request the backend "please use this kid to sign the attestation". and that "kid" can be determined in many different ways (time based, version based, etc.)

We are currently working on making ATProto OAuth easier on devs. This proposal is one of steps we are taking to make it happen. Stay tuned...

Here is why: If an app/spa gets compromised (XSS, supply chain attack, ...), confidential clients can revoke the private key that was used to authenticate compromised version of the app, effectively stopping the attack (assuming the "bug" was also fixed). Public clients have no such mechanism.

Yeah you'd probably hit the file size limit for the client metadata document pretty fast if you don't cleanup "old" uris.

If there is more than one redirect_uris in the client metadata, the client has to provide the one it wants the AS to use during PAR.

Hey @tom.sherman.is, assuming that we'd lift the "same origin" constraint on redirect_uris, would that be enough to allow Vercel preview apps to work ? How would you make sure that the redirect_uris from the (now single) client metadata document contains all the preview apps ?

We deliberately chose to add strong constraints to our initial spec so that they could be relaxed without breaking compatibility. The redirect_uris's "same origin" restriction is a good example of constraint we'd be willing to lift, based on feedback like this one.

👻

🔥

🥳

💙

It would be awesome if starter packs were automatically created from specific @smokesignal.events ! Like, I'm going to the AHOY! conference next week and I'd love to have an easy way to follow everyone else going.

Excited for the @ahoy.eu conf of next week.

A way you can avoid this, if you are developing a client, is to rely on client authentication. This should give you 30 days of refresh token validity in place of 2.

We are following OAuth 2.1 here:

> The authorization server MUST consider the security implications of interacting with unauthenticated clients and take measures to limit the potential exposure of tokens issued to such clients, (e.g., limiting the lifetime of refresh tokens).

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse. Ibi

plcfs 🫣

zuck wearing a shirt that says "aut zuck aut nihil"

jay graber, bluesky ceo, wearing a shirt that says "mundus sine caesaribus"

It's weird to me the they focus all that energy into new features while Zed is still missing some features that are absolutely needed needed for its adoption...

@atproto/api v0.14.0 release notes | Bluesky Today we are excited to announce the availability of version 0.14 of our TypeScript SDK on npm.

🚀 Just released a new version of our TypeScript SDK for Bluesky!

This update brings important improvements to the typings of our data model, making integration smoother and more reliable. Learn a thing or two about Bluesky’s API and the AT Protocol in the blog article we wrote for the occasion.