Publ: Development Blog

Entries tagged authl and IndieWeb

Publ 0.5.8, Authl 0.3.1, and IndieAuth security

Posted Wednesday, October 30 at 7:11 PM (9 months ago)

So, both Publ and Authl had a pretty na├»ve issue with the identity verification step of the IndieAuth flow; it simply accepted whatever the authorization endpoint said the user’s identity was. This made it very simple to spoof one’s identity and log in as anyone on any Publ or Authl site.

Authl 0.3.1 fixes the problem with the IndieAuth login flow, and Publ 0.5.8 fixes the problem with the Bearer token flow.

Authl v0.1.7, now with IndieAuth support!

Posted Monday, August 12 at 1:41 AM (11 months ago)

I’ve released Authl v0.1.7, which now adds direct support for IndieAuth (rather than requiring as a broker). This means that now folks who have an IndieAuth identity can log in using that; previously I was expecting to eventually open up client registrations to make that a useful authentication path, but for various reasons Aaron hasn’t opened it up to the general public.

Part of this update was to also refactor how OAuth is handled, so it’ll be a lot easier for me to add more OAuth-based providers in the future; hopefully I’ll have direct support for Twitter, GitHub, and maybe even Facebook in the near-ish future. But for now, between Mastodon, email, and IndieAuth, I think I have all of my own personal needs taken care of.

Feel free to make suggestions for other identity providers in the Authl issue tracker, though!