EVE Technology Lab

Everyone knows what a pain is the oauth flow for desktop applications. The need for the callback means we have to redirect the user to the browser, which makes a terrible user experience; use an embedded browser, which is not trustworthy from the user perspective; or register a local callback, which is not guaranteed to work and there's no possibility of protecting against such situation, since the callback is immutable.

Fortunately there is a possible solution, which is used by e.g. Dropbox - multiple callbacks. The flow is unchanged, but you can send one of the pre-configured callbacks which allows for detection of a problem with starting a local server and using the browser callback as a fallback. I propose implementing such mechanism for ESI, since it would make desktop applications much easier to use.

I've thrown the concept at them.

I _believe_ that the people working on ESI aren't the people who manage the SSO, but I could be wrong about that. Either way, it's been waved.