Friday, August 24, 2012

OAuth 2.0 (client) couldn't get any easier

Sanction

I'm pleased to introduce sanction, a Python OAuth 2.0 client in all of its 66 LOC of glory:

https://github.com/demianbrecht/sanction


Why another OAuth 2.0 client?


I found that most implementations were overly complex, sometimes adhering to architecture principles taught in school, sometimes not. All, however, simply felt much more convoluted and difficult to understand than I thought they should be. My initial attempt at writing my own client resulted in a ~450 LOC implementation that I was quite pleased with at the time. However, after a heated discussion with Jack Diederich, watching his talk "Stop Writing Classes", spending some time waist deep in Python in a professional capacity, subsequently buying into the slogan "We're all consenting adults here" and finally realizing that I didn't want to maintain the code unless there were bugs (I wanted to release a fire-and-forget library), I decided I wasn't so happy with it anymore.

So, after spending some time (again waist deep) with the OAuth 2.0 spec, I forged ahead with a rewrite and subsequently, surprised myself when it ended up being a whopping 66 LOC. This library shouldn't need to be updated when new providers are implemented. As long as the providers adhere to the OAuth 2.0 spec, it'll work out of the box. If there are deviations (such as Facebook and StackExchange), client code will need to be aware of it and handle it as shown in the example code (nothing special, 4 LOC to handle Facebook and StackExchange deviations).

Provider Support

As of this writing, sanction has been tested with the following providers:

Examples for each are included on github. Usage is detailed in the README.

The sanction library is also available and can be downloaded from PyPi.

No comments:

Post a Comment