Hi, regarding remote authorization, the proposed method seems complex. I suggest the following - each user can have multiple passwords.
1) In "del.icio.us remote auth settings" I can add/delete URLs. 2) Adding an URL returns a new password for my user, that only works for the given URL. 3) Removing an URL revokes password, thus denying the remote application's access to my data. 4) del.icio.is keeps a log for each interaction from the remote app - I can check it and audit what the remote app is doing. 5) I give my del.icio.us username plus my new password to the remote app. Plus: The user could be able to set permissions for each new URL. Example: just read,, read/write, just access tags: X1, X2, X2..., don't access to tags: Y1, Y2..., etc. Seems more simple and intuitive for the user. Sérgio Nunes > Date: Sun, 11 Sep 2005 23:13:50 -0400 > From: joshua schachter <[EMAIL PROTECTED]> > Subject: [delicious-discuss] remote app auth > > i'd like to put together a spec for letting users authorize remote > application access without giving away their actual password. > > here's a very preliminary idea: > > 1) remote webapp links to, say, del.icio.us/auth?return=http:// > place.to.send.auth.key/ > 2) user ends up on a page that tells him 'grant access to http:// > place.to.send.auth.key for write/read/decline' > 3) chooses read or write or whatever and is redirected to http:// > place.to.send.auth.key/?user=xyz&key=abc and this is logged to some > del.icio.us database. (or maybe this should be POST) > 4) api will accept either password or the auth key > > thoughts? > > -- > joshua schachter > [EMAIL PROTECTED] > _______________________________________________ discuss mailing list [email protected] http://lists.del.icio.us/cgi-bin/mailman/listinfo/discuss
