{
  "id": 19220917,
  "title": "Never Share Your Password Again — The OAuth 2.0 Solution",
  "url": "https://urgent.news/2026/11/09/never-share-your-password-again-the-oauth-2-0-solution",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T20:50:38.000Z",
  "source": {
    "name": "Stack Overflow Blog",
    "slug": "stack-overflow-blog",
    "url": "https://stackoverflow.blog/2026/11/09/never-share-your-password-again-the-oauth-2-0-solution/"
  },
  "original_language": "en",
  "account": "Before OAuth 2.0, third-party apps needed users' Twitter usernames and passwords to access their timelines. This practice, known as the password anti-pattern, was risky as breached apps could compromise all user accounts they had access to. Users could not revoke access to a single app without changing their password everywhere. OAuth 2.0 changed this by allowing users to authenticate with a trusted service (like Google or GitHub) and granting the app a token with specific permissions, time limitations, and the ability to be revoked. The token is exchanged through a flow involving the Authorization Code with PKCE, which employs several security-critical parameters: a state value for CSRF protection, a code_challenge and code_verifier for PKCE, and a pre-registered redirect URI to prevent attackers from hijacking the code. The authorization code is also short-lived and single-use, ensuring security even if intercepted. Scopes limit the app's access to specific permissions, such as calendar.read, preventing broader access that could lead to more severe breaches. OAuth 2.0, through its various components, makes it secure for users to grant third-party apps controlled access to their accounts without sharing passwords.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}