Does Yahoo and MS support Oauth 2.0? and few questions about oAuth 2.0

Question

i have several questions...

1. Does yahoo and microsoft api support oAuth 2.0?
2. If yes then what are the main security measures those should be taken care of while shifting from oAuth 1.0 to oAuth 2.0.
3. Google API supports oAuth 2.0. But they have still marked it as an experimental. Is it good to start shifting even though it is experimental?

4. I see while registering an application on google (for oAuth 2.0), they ask for callback url. If a single application uses a condition dependent callback url such as -

   if($myVar == NULL) $callbackUrl = 'http://www.mydomain.com/test.php?m=f&params=null' else $callbackUrl = 'http://www.mydomain.com/test.php?m=x&params=1'

How can i implement above when the callback url is already specified? The above conditional mainly handles fallback model of an application or if browser supports java then java based model of an application. Kindly suggest

1. May i know how many of email providing websites and social networks supports oAuth 2.0?

Answer 1

1. Yahoo does not support OAuth2 yet, only Oauth 1.
   Microsoft does support OAuth2. http://msdn.microsoft.com/en-us/library/hh243647.aspx

2. Oauth 2 is simpler since it uses SSL (HTTPS) to provide transport security, so the signatures and token-secrets are not needed. When you switch you will need to re-implement your OAuth flow. I can't think of any specific security measures specifically applicable to upgrading from OAuth1 to OAuth2, but the spec details some security considerations in section 10 (The parts applicable to clients are 10.3, 10.4, 10.5, 10.6, 10.8 and 10.9).

3. The OAuth2 specification is still not finalized, and may change. You could begin to implement your OAuth2 flow with Google, but bear in mind that it is possible that names or requirements of parameters, endpoints etc. could change and your application will break / you will need to make changes in future. [Experimental Features] could change (or even be removed) at any time. It is probably a bad idea to use experimental (or beta) software in a critical production environment.
   Also, not all Google services support OAuth2 at the moment. eg. If you want to use OAuth for IMAP access to Gmail you will have to use OAuth1 for now.

4. In the API Console, you can specify multiple callback URLs for your OAuth2 application, one per line. An alternative would be to store your 'm' and 'params' parameters in a browser session / cookie and do the redirect to the correct page once authorization is complete.

Support (some revision of) OAuth2: Facebook, Microsoft/Live, Google (with exceptions described above), Foursquare, GitHub, Gowalla, GeoLoqi, Salesforce.
Support OAuth1 Only: Yahoo, Flickr, Twitter.
Source.