Introducing a new #atproto tool from Streamplace: OATProxy! Tired of getting logged out of your apps every 2 days? OATProxy acts as a transparent XRPC proxy for your frontend application, upgrading your users from short-lived "public" OAuth sessions to robust, hearty "confidential" OAuth sessions. - ThreadSky

stream.place • 11 days ago

Introducing a new #atproto tool from Streamplace: OATProxy!

Tired of getting logged out of your apps every 2 days? OATProxy acts as a transparent XRPC proxy for your frontend application, upgrading your users from short-lived "public" OAuth sessions to robust, hearty "confidential" OAuth sessions.

Comments

stream.place•11 days ago

OATProxy is available both as a standalone microservice and as a Go library for embedding within larger Go applications.

It operates using existing ATProto OAuth libraries and requires only adding a few minor lies to your front-end code. Give it a shot and let us know what you think!

stream.place•11 days ago

OATProxy is already in production at Streamplace, enjoy staying logged into the app for longer!

sababa.bsky.social•11 days ago

Sounds fabulous, way over my head tho. Love the streams

erlend.sh•11 days ago

“few minor lies” 😂

iame.li•11 days ago

entirely forgivable! you had your fingers crossed the whole time

xan.lol•11 days ago

yay! i hope this, or something similar, gets added to @flushes.app - that would be a huge improvement in my life (probably save me a minute or so per day 😜)!

dame.is•11 days ago

you are a true soldier

iame.li•11 days ago

plenty of fiber in OATs

dame.is•11 days ago

can it be implemented in my sleep for overnight OATs?

iame.li•11 days ago

once fully processed they've got a shelf-life of up to a year!

natalie.sh•11 days ago

tempted to use this for https://teal.fm solely for auth lifetimes

iame.li•11 days ago

nice hot bowl of OATteal for breakfast

shi.gg•11 days ago

adding confidential oauth from scratch was such a pain in the a** with wamellow (I have libphobia, I hate using packages xd)

10xchris.bsky.social•11 days ago

Thx for sharing this. I’ll take a look for sure

tom.sherman.is•11 days ago

Gonna claim that I manifested this one into existence

So does DPoP happen in the client?

iame.li•11 days ago

Affirm, that's part of the reason I wanted to preserve @atproto/oauth-browser support - the DPoP keys are securely stored in a non-exportable IndexedDB table, you're immune to "just copy this JavaScript snippet into your inspector for free bitcoins" kind of attacks. Neat!

mackuba.eu•10 days ago

I'm assuming "non-exportable" means "not easily exportable"? I don't know how it's stored, but surely it can be exported if you're determined enough

iame.li•10 days ago

Yeah that's right - it's inaccessible from userland JavaScript unless there's a bug but actual storage on disk would be up to Chrome or Firefox or whatever. The dream would be that they could use hardware enclave support (especially on a Mac) but who knows

mackuba.eu•2 days ago

Hey, I'm wondering, what does it mean that it's not accessible to userland JS? Like, if I open the web inspector when I have the given website open and paste some JS there to make a query, I can't get that value? (If so, how does the website get it?…)

tom.sherman.is•2 days ago

Yeah that's right. There are browser APIs that allow you to use the key for signing and encrypting but don't allow you to access the key itself

Comments

Posting Rules

Reply