…because people don’t read the docs and instead just assume that it works how they think it should.

Have you seen the oauth docs? I can’t imagine anyone having read and understood them fully, unless you dedicate your life to it.

Half of it I think is because people take "basic auth" offered by web framework, and then try to retrofit OAuth/OIDC/SSO on top of it.

If so many people are making the same mistakes, it’s your fault, not the users.

Sounds like a classic footgun to me.

If people don’t read, it’s their fault. Reading the docs is not a big ask.

Documentation (including code comments) are vital and important, but it's far better to bake the proper constraints into the code/specs so that it's hard to make mistakes. Then the docs are less necessary, shorter, and easier to understand. I think this is what GP is getting at.

I don't think that's engineer so much as lazy bureaucrat in power. It's the mentality Douglas Adams made fun of with the "Your planet is being destroyed, you had plenty of time to read the posted notice".

How dare we read documents before we put technology into use.

Like asking a bridge engineer to know the spec of his bolts.

And if every purchaser of said bolts implemented them incorrectly, is it more likely that your specs, docs, or bolt design are faulty? Or do you just think no it’s everyone else who is stupid?

Except in this case the vast majority of people have read the docs and then gone on to implement them correctly.

I’m sorry that you wrote buggy code because you didn’t read. But it’s the height of arrogance to assume that because you did, everyone else surely must have as well.

This is why login is a horrid mess. Because if it's too easy then people who don't know what they are doing set up websites.

When some people ask why most of us sane and practical folks still use and demand simple password authentication, it's because passwords fucking work.

I'm still firmly in the mutual TLS camp. Nothing is easier then never having to type in a password and good luck cracking TLS.

So much this. OAuth and their ilk are, in my opinion, not trustable and suffer from real usability issues.