I have written an implementation for OAuth1 and OAuth2.
I liked the protocol/framework so little that I started implementing a new one. But soon I realized that a lot of the difficulties come from having this thing run on top of HTTP, and that I could not access any security feature of the lower levels.
So (IMHO) everything implemented on top of HTTP, or the whole idea of having isolated layers of security is doomed to have problems and will cause headaches to anyone working with it, aside from requiring developers to be security experts.
But I still didn't stop and my master thesis now is a complete secure rewrite of protocols from tcp, tls to OAuth.
The project is on fenrirproject.org if you want to comment it. Lots of work, I am aiming to an implementation in half a year.
Please feel free to drop me a line.
I liked the protocol/framework so little that I started implementing a new one. But soon I realized that a lot of the difficulties come from having this thing run on top of HTTP, and that I could not access any security feature of the lower levels.
So (IMHO) everything implemented on top of HTTP, or the whole idea of having isolated layers of security is doomed to have problems and will cause headaches to anyone working with it, aside from requiring developers to be security experts.
But I still didn't stop and my master thesis now is a complete secure rewrite of protocols from tcp, tls to OAuth.
The project is on fenrirproject.org if you want to comment it. Lots of work, I am aiming to an implementation in half a year. Please feel free to drop me a line.