The current documentation laid out in #171 targets a BASIC-style auth. Following discussions with the rest of the team, we need to instead target a single auth style that is a bit more future-proof. The resulting implementation needs to be:
- Standard
- Straightforward for both clients and servers to implement
- Extensible
- Secure
From my research, the best approach is to implement Authorization Code Flow with Proof Key for Code Exchange (PKCE). This flow enables good security with a well-documented flow. Servers may either make use of an existing auth server, or implement their own. The expectation is that clients only need to support a single auth flow to interact with any OPA server.
The current documentation laid out in #171 targets a BASIC-style auth. Following discussions with the rest of the team, we need to instead target a single auth style that is a bit more future-proof. The resulting implementation needs to be:
From my research, the best approach is to implement Authorization Code Flow with Proof Key for Code Exchange (PKCE). This flow enables good security with a well-documented flow. Servers may either make use of an existing auth server, or implement their own. The expectation is that clients only need to support a single auth flow to interact with any OPA server.