Kuba Suder 🇵🇱🇺🇦

@mackuba.eu

Indie Mac/iOS & web developer • Currently building random fun things on ATProto using Ruby and occasionally JavaScript → https://blue.mackuba.eu "mostly-happy-but-occasionally-grumpy Ruby guy" - Why 🌍 Kraków, Poland 🇵🇱🇪🇺 • ✝️

Skythread login dialog with a tab toggle: Password / OAuth (experimental)

OAuth screen "beta.skythread.mackuba.eu wants to access your @mackuba.eu account. Deny access / Authorize"

token_endpoint_auth_method (string, optional): confidential clients must set this to private_key_jwt.

$"error": "invalid_client_metadata", "error_description": "Unsupported client authentication method \"client_secret_basic\". Make sure \"token_endpoint_auth_method\" is set to one of: \"none\", \"private_key_jwt\""'$

internet connection, so it looks like a normal person on Comcast or AT&T. Almost no one intentionally runs one on behalf of bad actors, they’ve been tricked or hacked. Usually it’s one of a few things:

A free VPN app reselling your bandwidth.
A proxy SDK buried in some free game.
Malware on a computer, router, or smart TV.

Jerry Chem and 2 others liked your post (about Jerry)

Poe Dameron in Star Wars episode 9 saying "Somehow, Jerry returned"

$oauth-client-metadata.json: { "client_id": "https://skythread.mackuba.eu/oauth-client-metadata.json", "client_name": "Skythread", "client_uri": "https://skythread.mackuba.eu", "policy_uri": "https://blue.mackuba.eu/privacy", "application_type": "web", "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"], "dpop_bound_access_tokens": true, "scope": "atproto transition:generic", "redirect_uris": ["https://skythread.mackuba.eu/?callback"] }$

Guy hiding in a swan-shaped tent floating on a lake, with a hole for the camera lens

Security Extensions to Always Consider
• PAR - Moves parameters to back-channel (ATProto:
Supported)
• DPoP - Prevents token theft (ATProto: Recommended)

for ipv6. So instead of accessing your project from
http://localhost:5173 you would use http: //127.0.0.1:5173 in your web browser's address bar
• (my highlight) Must start with http://localhost (end highlight)
• You can then set a query parameter of redirect_uri and set it to your callback endpoint. This can be the ip address and port number like
redirect_uri=http://127.0.0.1:3000/oauth/callback. You also have to use a loopback address like 127.0.0.1 here and not localhost

$Blessed DID Methods Currently, atproto supports two DID methods: did:plc: a self-authenticating DID method developed specifically for use with atproto. See the DID PLC website for more details. did:web: a W3C community draft based on HTTPS (and DNS). The identifier section is a hostname. This method is supported in atproto to provide an independent alternative to did:plc. See usage details below It is possible that other methods will be supported in the future, but the intention is to keep the "blessed" set as small as possible. It is certainly not the intention to support all or even a significant fraction of all DID methods.$