What Web Bot Auth deliberately leaves out

Your API doesn't need to know who's calling. It needs to know if a human is behind the call. The IETF Web Bot Auth working group just published its charter draft. I read it twice, because one line in the scope section wouldn't let me move past it: end-user authentication is explicitly out of scope. That's not an oversight. It's a design choice,... Weiterlesen