Having adapted an example OpenID Connect server (built in Rails) to a production system, I need to add PKCE support so that it could be used securely to allow mobile systems to log in. OAuth2 (and therefore OpenID-Connect) isn't considered as secure on mobile devices because rogue applications on the mobile device can hijack the authorization code. Here I'll try to describe the thought process that goes into not the implementation, but the interpretation of the spec into a set of tests that will allow us to be reasonably confident that mobile clients will be able to connect. (Pleasingly, the first time the mobile integrators tried to connect with PKCE it worked perfectly, both with errors and successful paths). My implementation is in Ruby, of course, and my tests will be in RSpec with expectations, so some of the language might not be generic but the concepts should map to other languages / frameworks. I've marked the actual tests I needed in yellow with the word TEST:...
I'm pretty sure that my last bank holiday was ruined by Internet Explorer 8, and now that our clients have dropped that from their supported version list, its younger brother has stepped up to the plate to try to ruin this bank holiday for me. A stylesheet which works fine on Firefox, Safari, and Chrome (and even works tolerably on IE8, incidentally), inexplicably fails to apply a huge number of styles on IE9. This is a delightful thing to find out essentially 1 working day before a planned release. We can of course go into some life lessons learnt, but they might come out a bit on the grim side (i.e. never trust anyone else to check anything, you will always have to fix everything yourself). So nuts to that. This is about technical lessons learned. Here are some things I've found so far: This project has some pretty terrible CSS, a product of stuff being layered on top of other stuff forever. Code decays, and CSS decays particularly fast, it seems. When you look at the...