Company
Date Published
Author
Dan Moore
Word count
2787
Language
English
Hacker News points
None

Summary

The Grant Negotiation and Authorization Protocol (GNAP) is currently being formulated in an IETF working group. It will not be backward compatible with OAuth2, but aims to address similar problems, such as tight coupling of the auth process to redirects, archaic developer ergonomics, and limited deployment of sender-constrained tokens. GNAP includes features like multiple access tokens, interactions that are first-class concepts, continuation of a grant, built-in identity, and developer ergonomics. It is designed to make OAuth-style authentication easier to use and provides extension points for future communication. The protocol is still in the discussion and iteration stage, but its release is expected to begin in the middle of 2021. Users who are happy with OAuth2 should continue using it, while authorization server vendors and developers may want to take note of the GNAP spec and consider contributing or implementing it.