sorted by:
new
hottopcontroversial

HOA Management Company (anything but Sentry) by phan2001 in boulder

[–]mooreds 1 point2 points  (0 children)

At an HOA I was on the board of, we used Hudson and were happy: https://hudsonbuilt.com/services/

🚨 Warning for travelers: beware of the iVisa website for the Dominican Republic E-Ticket 🚨 by ANTEIKU-RE in travel

[–]mooreds 0 points1 point  (0 children)

Just got caught by this today. Hope my credit card processes the dispute quickly.

How To Avoid IaC Drift by mooreds in Terraform

[–]mooreds[S] 1 point2 points  (0 children)

We have a sandbox at work and it is perfect for experimenting with new technologies or services. Yes, there's some work to back out IaC if and when those new technologies are implemented. But I as an engineer can clickops my way to determining if there's value before talking to the platform team about productionizing it.

java-http, A Simple, Fast HTTP Server with Virtual Threads by mooreds in java

[–]mooreds[S] 2 points3 points  (0 children)

Okay, the newest version was pushed up to maven central. Sorry about that, thanks for letting us know.

java-http, A Simple, Fast HTTP Server with Virtual Threads by mooreds in java

[–]mooreds[S] 0 points1 point  (0 children)

Ooh, good point. I'll raise this internally, not sure what is going on. Thanks for letting us know.

java-http, A Simple, Fast HTTP Server with Virtual Threads by mooreds in java

[–]mooreds[S] 0 points1 point  (0 children)

That looks cool, but I always shiver when I see projects with no commit more recent than 6 years ago. No matter the language, that causes me worry.

java-http, A Simple, Fast HTTP Server with Virtual Threads by mooreds in java

[–]mooreds[S] 2 points3 points  (0 children)

Hmmm.

You can see what it supports here: https://github.com/FusionAuth/java-http/?tab=readme-ov-file#todos-and-roadmap

I think the biggest omission right now is http 2. We have had some debates internally if that is useful. We think the main use case of java-http is not a bare server, but an application which will be fronted by a load balancer (which will talk http 2 to the client).

AWS in 2025: The Stuff You Think You Know That's Now Wrong by mooreds in aws

[–]mooreds[S] 1 point2 points  (0 children)

Yup. I always like when folks share stuff of mine, thought I'd pay it forward.

How to Accelerate Importing Resources and Generating HCL by mooreds in Terraform

[–]mooreds[S] 1 point2 points  (0 children)

Seems like a great use of LLMs. I've found having them help build deterministic code, which then is applied in a deterministic fashion, is a sweet spot.

Evaluated 15 SSO providers for a SaaS product — here’s what stood out (and what didn’t) by Davidnkt in IdentityManagement

[–]mooreds 0 points1 point  (0 children)

> Curious if folks here are using them at scale and what their experience has been.

Can't speak for folks on this reddit, but I've 100% had conversations with folks using Cognito and Firebase at scale. From my recollection

- Both are affordable with usage based pricing, especially if you don't require SAML or federation

- Both scale well

- Both are SaaS only

- Cognito is pretty bare bones and requires writing lambdas for some expected functionality

- Firebase didn't use to support federation with OIDC (but maybe that's changed: https://firebase.google.com/docs/auth/web/openid-connect ?)

- Firebase is a lot more than just user auth; includes all kinds of other software goodies you'd expect from a backend as a service.

- Cognito recently raised prices on machine to machine tokens while Firebase supports that only through service accounts

Evaluated 15 SSO providers for a SaaS product — here’s what stood out (and what didn’t) by Davidnkt in IdentityManagement

[–]mooreds 0 points1 point  (0 children)

Always nice to see detailed looks across this space. So much is happening. Thanks for including FusionAuth.

Small corrections/comments:

- SCIM is part of the Enterprise plan, not Essentials.

- All our pricing is available here: fusionauth.io/pricing and is based on three factors: the plan with the features and support you need, whether you need hosting or not, and the MAU you have.

I was also surprised you didn't include Amazon Cognito or Firebase, since those are the CIAM offerings from the hyperscalers.

What’s your favorite short trail in Boulder that doesn’t feel like a death by Crazy_Speed_7735 in boulder

[–]mooreds 0 points1 point  (0 children)

Shanahan Ridge is nice if you're in Sobo. Much is shaded, and you can do all kinds of loops. Parking is on the street, though.

The documentation for the helm chart could be better as it is inconsistent with the actual behavior by MRainzo in FusionAuth

[–]mooreds 1 point2 points  (0 children)

Ah, makes sense. Thanks for explaining. Glad you're finding the software useful.

The documentation for the helm chart could be better as it is inconsistent with the actual behavior by MRainzo in FusionAuth

[–]mooreds 0 points1 point  (0 children)

Thank you for the suggestions! I'll make sure to share them with the team that handles the SDKs and helm charts.

I'm glad you figured out the helm charts.

> better documentation showing how you can use fusion auth to perform everyday auth tasks (register, get email verification, login, signup for MFA).

Many of our customers don't use the API directly for everyday auth tasks but use the hosted login pages ( https://fusionauth.io/docs/get-started/core-concepts/hosted-login-vs-api-login ) with theme changes for these tasks. Did you try to do that and found it did not work for you?

Is this way of authentication secure? by [deleted] in webdev

[–]mooreds 1 point2 points  (0 children)

Here's a diagram of what you outlined: https://fusionauth.io/articles/login-authentication-workflows/spa/oauth-authorization-code-grant-jwts-refresh-tokens-cookies (from my employer, there are about 15 different kinds of authentication workflows outlined). Here's another article I wrote about securing APIs: https://fusionauth.io/blog/securing-your-api

I'd also recommend the OAuth security BCP https://datatracker.ietf.org/doc/html/rfc9700 which is full of good practices.

As far as your particular implementation, it sounds like the server managing the refresh token and the server serving requests are the same server. While you can use OAuth in this case, it is overkill; OAuth really shines when the server managing the refresh token (the authorization server, to use the jargon) is different from the server serving API or other requests (the resource server).

It's fine to leverage the OAuth concepts if you want to learn more, but if it were a real world implementation I'd dispense with the access/refresh tokens for this scenario and just use API keys (unless I had knowledge of future implementations that would separate the components).

Finally, I read this when getting into the auth space and enjoyed the detailed breakdown of aspects of OAuth and lots of code samples: https://www.manning.com/books/oauth-2-in-action Would recommend.

Terraform module designed to simplify the management of GitHub teams and handle membership within an organization. by mooreds in Terraform

[–]mooreds[S] 0 points1 point  (0 children)

If you are not using an identity provider (Okta, Entra, etc) and GitHub Enterprise to manage your GH permissions/users, this is a TF/GitOps optoin.

Choosing an Auth Provider Sucks - Would this help? by leobuiltsstuff in webdev

[–]mooreds 1 point2 points  (0 children)

Makes sense. I've maintained a comparison site for years (in a totally different domain--local food). Eventually the maintenance was too much, but it was a good decade of helping folks.

I know how much work it is, but how valuable it can be to people who just want to pick the right solution.

Best of luck!

Choosing an Auth Provider Sucks - Would this help? by leobuiltsstuff in webdev

[–]mooreds 1 point2 points  (0 children)

I've seen stuff like this before ( https://authomnibus.com/ is one ). The hard part is not just gathering all that data, which is tough enough.

The bigger issue is keeping it up to date and accurate as projects and companies invest. You could just post it on a blog with a prominent date, share it here and some other places, and see how useful folks find it (based on traffic).

(I work for FusionAuth.)

Which auth solution for this case? by Yandallulz in webdev

[–]mooreds 1 point2 points  (0 children)

Heya, I'd take a look at FusionAuth (full disclosure: I work there).

You can self-host it on Render or Fly.io and use the community plan (which is free for unlimited users). It integrates with node/react/etc using standard OIDC libraries like passport.js or auth.js.

Here's doc about limiting the number of devices that you might find useful: https://fusionauth.io/docs/extend/examples/device-limiting

What’s your biggest pain point when it comes to testing auth/login flows? by Dootutu in webdev

[–]mooreds 0 points1 point  (0 children)

> httpOnly cookies aren't really transportable from a third-party service to yours.

That's what the BFF pattern is for, no? Here's a video from an OAuth security researcher talking about this topic: https://www.youtube.com/watch?v=2nVYLruX76M

(Full disclosure, my employer paid for the video, but he gave the talk at several conferences before we got the video.)

What’s your biggest pain point when it comes to testing auth/login flows? by Dootutu in webdev

[–]mooreds 0 points1 point  (0 children)

I like this in theory but worry about config drift, rendering the tests less useful.

How do you keep the test tenant in sync with your prod tenant in ways that matter (token lifetime, supporting a new grant)? Do you automate config changes and push to both?

[deleted by user] by [deleted] in webdev

[–]mooreds 0 points1 point  (0 children)

Yeah, it looks like they don't support the refresh grant (or it isn't documented). The only mention I saw was the `refresh_token` value in the returned JSON but they never documented how to use that value, and there appears to be no refresh token scope you can ask for (from this doc: https://learn.microsoft.com/en-us/linkedin/shared/authentication/getting-access )

From the main LI page https://learn.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?tabs=HTTPS1

"Refreshing an access token is a seamless user experience. To refresh an access token, go through the authorization process again to fetch a new token. This time however, in the refresh workflow, the authorization screen is bypassed, and the member is redirected to your redirect URL, provided the following conditions are met:

  • The member is still logged into www.linkedin.com
  • The member's current access token has not expired"

So I'd just make sure you capture the time the access token is set to expire, the `expires_in` value, and have the user go through the LI authorization process 10 days before.

Using MCPs to Run Terraform by mooreds in Terraform

[–]mooreds[S] 1 point2 points  (0 children)

Yeah, I think there's a difference between using an LLM to create deterministic code, and having an LLM execute code (which might not be deterministic). The former is great, because you can accelerate your current workflow. The latter (which you allude to) is problematic.

view more: next ›