April 24, 2009

OAuth Update #2

On Wednesday, upon discovery of security issue within the OAuth protocol, we disabled the ability for users to authorize new applications via OAuth on Yahoo! (apps that had already been authorized were not affected). Obviously, this has been a challenge for you as developers since you haven’t been able to test any apps that rely on our Y!OS Updates, Social Directory, Status, Contacts, or Fire Eagle APIs .

After working on the problem yesterday, we’ve now decided to turn OAuth back on for developers testing their own apps on Yahoo!, but with the addition of a new interstitial warning screen preceding the normal Yahoo! OAuth permissions flow. Here's a screenshot of the warning screen:

Basically, we’ve decided to re-enable OAuth so that you can test your own apps and not slow down your development cycles. If you choose do so, we recommend creating a test account and using test data.

Please keep in mind that we are strongly discouraging Yahoo! end-users from authorizing new apps that use OAuth until this security issue is resolved.

As we mentioned yesterday, we’re actively working with the OAuth community to solve this security issue. Stay tuned for updates.

Best,
Allen Tom
Architect, Yahoo! Membership

Posted at April 24, 2009 1:16 PM | Permalink

Bookmark this on Delicious

Comments

Posted by: Girish at April 25, 2009 9:17 AM

Posted by: Jesús at April 25, 2009 1:04 PM

Posted by: Cody Simms at April 26, 2009 8:41 AM

Posted by: Geek Reloaded at May 3, 2009 9:12 AM

Posted by: SSJ at May 21, 2009 2:21 AM