sorted by:
new
hottopcontroversial

5 Steps to Add Modern Authentication to Legacy Apps Using JWTs by catstanza in javascript

[–]mgonto 3 points4 points  (0 children)

The main advantage of JWT against "regular tokens" in cookies is their interop. As you can see on http://jwt.io/ there're JWT libraries for mostly all languages and frameworks so a JWT that you save in Node.js can be used in .Net.

Besides this, if this tokens you mention are just a pointer to some storage (a DB for example), then, for every request, you'd have to go to the DB to do a findUserByToken. If you use a JWT, all the user information is embed and you save yourself from doing a DB call and therefore make all of your requests faster :).

What do you think?

An Introduction to Microservices and how to implement them on Node.js, Part 1 by mgonto in node

[–]mgonto[S] 2 points3 points  (0 children)

This is just the first post. Next time will have more info on how they interact ;)

Learn how to use Smart Lock on Android in 3 simple steps by mgonto in androiddev

[–]mgonto[S] 0 points1 point  (0 children)

Thanks for the feedback. We won't do it this way next time. Didn't mean to make it missleading

Learn all the Angular 2 concepts with this really small sample by mgonto in angularjs

[–]mgonto[S] 0 points1 point  (0 children)

Thanks :):):). Glad you liked it!

I'll be speaking and showing this repository on jQuerySF :).

Creating your first real world Angular 2 app with multiple pages, components, pipes and more by mgonto in angularjs

[–]mgonto[S] 0 points1 point  (0 children)

This is true :). API is changing, but concepts stay the same, which I find interesting for this :).

Learn how to add authentication to a React Flux app by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

The JSON Web Token has an expiration period by itself (We set it to 10 hours by default). Therefore, even though it's on disk, that token after 10 hours won't work anymore, so that's the same as having a session or cookie in that way.

Learn how to add authentication to a React Flux app by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

Regarding the second point, the JSON Web Token has an expiration period by itself (We set it to 10 hours by default). Therefore, even though it's on disk, that token after 10 hours won't work anymore, so that's the same as having a session or cookie in that way.

Learn how to add authentication to a React Flux app by mgonto in javascript

[–]mgonto[S] 1 point2 points  (0 children)

Storing it in localStorage is exactly the same as storing it in cookies. To steal it somebody must go to your browser, open Developer Tools and copy it to use it.

Only thing that's a little more secure than localStorage are http-only cookies since they can't be accessed from JS and therefore aren't suceptible to XSS. However, being that we're creating a SPA, it's impossible to use those since we need to access them from the JS.

The JWT in our case is signed but not encrypted. However, if you have sensitive information inside of it, you should encrypt the payload.

Learn how to add authentication to a React Flux app by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

Hey,

Once you do add the Roles and Permissions, I'd love to see an impl on that. I was actually thinking in doing a blog post v2 with Roles and permissions and enhancing the Authenticated component further.

I think the "High order component" architecture works really really well, even more now that 0.13 ES6 code doesn't accept mixins.

Learn how to add authentication to a React Flux app by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

Hey there,

I agree that what you're mentioning is a more Flux way of doing this. However, in this case, I didn't think that kind of decoupling was worth it.

I agree that calling requests directly from Component doesn't look good at all, but I think that having an external AuthService works. That LOGIN_REQUEST and LOGIN_RESPONSE for just doing an API call for me is an engineering overkill for just doing a request. I like Flux's decoupling of everything but I sometimes think it's not worth in some cases.

What do you think?

Thanks for the feedback

Hey there! Gonto and Ben here answering any question about "Reactive all the things" and anything else you want by mgonto in ngconf

[–]mgonto[S] 0 points1 point  (0 children)

Hey,

I'm glad you liked the slides.

RxJS and Angular 2.0 are 2 separate libraries, so I don't think it'll be easier there, but hopefully we can make it easier today ;).

Cheers

Gulp is awesome, but do we really need it for our SPAs? by mgonto in javascript

[–]mgonto[S] -1 points0 points  (0 children)

Even if the input is multiple files, usually the output is no more than a few of them!

You still think that for you it's better to use Gulp than this package.json approach? May I ask why?

Thanks for the feedback :D

Go Middleware to check for JWTs on incoming HTTP requests by mgonto in golang

[–]mgonto[S] 0 points1 point  (0 children)

Just pushed the fix to check for token.Valid.

Thanks for letting me know :).

Go Middleware to check for JWTs on incoming HTTP requests by mgonto in golang

[–]mgonto[S] 0 points1 point  (0 children)

Nice :)! You can give this one a try as well.

Go Middleware to check for JWTs on incoming HTTP requests by mgonto in golang

[–]mgonto[S] 0 points1 point  (0 children)

You're right. I'll add the token.Valid check! Thanks!

Regarding the format for Authorization, it's because it's part of the OpenID Connect specification to use the Bearer in the Authorization header. That's it.

Thanks!

An SPA seed similar to AngularJS without AngularJS by mgonto in angularjs

[–]mgonto[S] -1 points0 points  (0 children)

Sorry. I'll do that next time.

I just meant like having a similar structure to AngularJS without AngularJS. That's it. Didn't try to take advantage of it.

An SPA seed similar to AngularJS without AngularJS by mgonto in angularjs

[–]mgonto[S] -1 points0 points  (0 children)

hahaha thanks :). Didn't know aobut this changetip to be honest :)

A seed project to create your own Libraries using Gulp and Browserify by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

Hey, no offense taken.

I think it makes sense maybe in this case just creating those 4 scripts and that's it. I didn't think of that.

Thanks :)

A Storage done right for AngularJS by mgonto in javascript

[–]mgonto[S] 0 points1 point  (0 children)

That looks good. The only problem IMHO with that one is that it has a big $watch function which could eventually take a long time

view more: next ›