Overwhelming error handling and error code complexity
5/10 MediumOAuth 2.0 specifies many error codes that developers must handle individually. Scattered documentation and unclear error messages make debugging difficult and error handling implementation tedious.
Sources
- OAuth 2.0 Common Issues: What You Need to Know
- A P I PA I N - P O I N T S
- Common Usability Issues with Web APIs: And How Discovery Can ...
- devRant - MSAL, Microsoft's absolute dumpster fire of an authentication library. Who in their right mind designed this overcomplicated mess? The documentation reads like it was written by a committee of drunk orangutans throwing darts at a keyboard. Want to do a simple login? HAHAHA GOOD LUCK! Here's 47 different configuration options you need to set up, three different flow types that are basically the same thing with slightly different names, and error messages that might as well be written in hieroglyphics. "AADSTS700054" yeah that's SUPER helpful, thanks Microsoft! And don't even get me started on token caching. Oh, you thought your tokens would just... work? NOPE! Hope you enjoy debugging why your perfectly valid token is being treated like a expired coupon at a grocery store. The refresh token flow is about as reliable as a chocolate teapot. I worked on a great project that was later axed and part of that was because of Msal issues. We literally only dealt with Msal issues. The app was otherwise stable. There were always issues with SSO, login, token validation... It just couldn't work, like, at all. I could see the clients getting fed up of the constant issues, yet, they couldn't move away from Microsoft since they'd already invested into their entreprise ecosystem. AzureAD, Office 365, you name it. Shit like this is why I laugh whenever someone suggests that AGI will take over the world. Like, bro, we still haven't figured out how to make an auth library that actually works, and you think we're close to making a machine capable of thinking like a human? Yeah right!
- Improving OAuth 2.0 Developer Experience - Hoop.dev
Collection History
Want to do a simple login? HAHAHA GOOD LUCK! Here's 47 different configuration options you need to set up, three different flow types that are basically the same thing with slightly different names, and error messages that might as well be written in hieroglyphics.
Confusing error codes. Even when developers set out to define clear error codes, the curse of knowledge often comes into play. Responses have incorrect status codes or status descriptors, are missing necessary headers, or include empty bodies when it's more appropriate to return a resource.
Then there's the issue of handling errors. OAuth 2.0 has a lot of error codes, and you've got to handle them all. That can be a lot of work, and it's easy to miss something.