Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Blurry Moon@sun@shitposter.world (2026-08-15 22:10:33)
@FloatingGhost @romin yeah so in our specific case every miniapp creates its own oauth app thats locked to its own domain url for the credential handoff. there's also a one-time authorization code that is only known by the first application when it's handed off, so if you tried to resubmit it it would have to have the initial attempt in its own database with the same authorization code, which it wouldn't have and wouldn't know. I guess if a miniapp was coded badly it could just not check and the rogue one could take over the buggy one.

---Replies---

Blurry Moon@sun@shitposter.world (2026-08-15 22:18:15)
@FloatingGhost @romin miniapps "not implementing oauth correctly" unfortunately is a real security lynchpin :mexican_sadge: