{"action":"opened","issue":{"url":"https://api.github.com/repos/hummingbird-me/hummingbird/issues/587","labels_url":"https://api.github.com/repos/hummingbird-me/hummingbird/issues/587/labels{/name}","comments_url":"https://api.github.com/repos/hummingbird-me/hummingbird/issues/587/comments","events_url":"https://api.github.com/repos/hummingbird-me/hummingbird/issues/587/events","html_url":"https://github.com/hummingbird-me/hummingbird/issues/587","id":89198970,"number":587,"title":"OAuth2 Rollout and APIv1 Login Deprecation Discussion","user":{"login":"NuckChorris","id":430411,"avatar_url":"https://avatars.githubusercontent.com/u/430411?v=3","gravatar_id":"","url":"https://api.github.com/users/NuckChorris","html_url":"https://github.com/NuckChorris","followers_url":"https://api.github.com/users/NuckChorris/followers","following_url":"https://api.github.com/users/NuckChorris/following{/other_user}","gists_url":"https://api.github.com/users/NuckChorris/gists{/gist_id}","starred_url":"https://api.github.com/users/NuckChorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NuckChorris/subscriptions","organizations_url":"https://api.github.com/users/NuckChorris/orgs","repos_url":"https://api.github.com/users/NuckChorris/repos","events_url":"https://api.github.com/users/NuckChorris/events{/privacy}","received_events_url":"https://api.github.com/users/NuckChorris/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-18T04:53:11Z","updated_at":"2015-06-18T04:53:11Z","closed_at":null,"body":"(cc @Mikunj @fractalemagic @erengy @inket @z411 and any other third-party devs)\r\n\r\nWith #583 fast approaching (about 8 hours of work remain before we can start doing QA), I'd like to open a discussion regarding rollout and deprecation plans for the APIv1 login system.\r\n\r\nOAuth2 will provide a near-drop-in replacement for the APIv1 login in the form of the [Resource Owner Password](http://tools.ietf.org/html/rfc6749#section-4.3) grant alongside the `all` or `apiv1` scopes.  The only real difference is in the response schema and the requirement of staff review for access to features such as the password grant and the `all` scope — though honestly, we'll be rubberstamping almost all current clients.\r\n\r\nWhat makes OAuth2 interesting is that we can actually make it more secure with time.  APIv1's login was a security dead end.  With OAuth2, we can incessantly nag our beloved third-party developers to reduce their scopes and switch from the password grant to other grant types.\r\n\r\nTo this end, I'm recommending the following rollout/deprecation schedule, and would like to hear feedback from the rest of the team, our contributors, and all our app developers.  Users who refuse to update?  OAuth2 killed your waifu?  Please tell me so we can work out a solution.\r\n\r\nFirst we'll push a beta.  During beta, we'll work alongside third-party developers to work out any kinks.\r\n\r\n* Beta (Day 0)\r\n   * Announcement post in dev/api along with explanation, links to libraries and OAuth Bible\r\n   * New tokens issued by APIv1 are tagged as such so we can handle them separately\r\n\r\nAfter things look stable for a week or so, we'll call it final and move to Gold Master.\r\n\r\n* Gold Master (Day 0)\r\n   * APIv1 login deprecated (not removed!) in favor of OAuth2 with `apiv1` or `all` scope and `password` grant\r\n* Gold Master (4 Months Later)\r\n   * Tokens issued by APIv1 (identified by above tagging) are no longer accepted by the rest of the site or on the forums\r\n* Gold Master (8 Months Later)\r\n   * Look for any remaining clients using APIv1 login, email the developers.  Unauthenticated APIv1 applications will continue working as usual.\r\n* Gold Master (1 Year Later)\r\n   * APIv1 login is removed entirely\r\n* <strike>Gold Master (10 Years Later Ver.)</strike>\r\n   * <strike>We meet at the Secret Base and ghost and a reunion happens</strike>\r\n   * <strike>Cry like a bitch because AnoHana</strike>\r\n\r\nI want to make sure we have Taiga, Trackma, Deadman, Tenpenchii, Anitro, and HAPU onboard for this process.  I know it sounds crazy, and the Pull Request implementing it is _fucking insane_, but it's really quite simple from the perspective of an app developer."}}