Hacker News Reader

What's worse is when OAuth providers force the refresh tokens to be refreshed! Many OAuth providers are now requiring user-action (ie. re-walk through the oauth popup) every x months to get new refresh tokens.

View on HN

As a user I am actually okay with this. That way if I haven't visited a website in a long time, then most likely they should no longer have access to my account.

Maybe I've long moved on and forgotten about that one site that I authorised and now they are using my data in a way that I wouldn't approve of.

The tricky part is for services like IFTTT (where I used to work) and Zapier (where the GP works) where you do want an authorization to be indefinite and not require user interaction because it's a background job.

Reply on news.ycombinator.com