Ask HN: What do you use for authentication and authorization?
111–120 of 247 posts
Re: Ask HN: What do you use for authentication and authorization?
#112Earlier quoted context omitted.
If you have to track revoked tokens you might as well track active sessions via a session ID.
That's just an argument ignoring the realities of scale. In any reasonable system the number of tokens that need to be held in blacklist until seen will be tiny in comparison to active sessions.
How does it matter how many tokens are in the blacklist? You're looking them up in a DB where the lookup time in lg(n) anyway. To give you an idea of how little it matters, let's say a small blacklist would be 10k tokens while a list of all tokens would 10M. log(10k) = 13.28. log(10M) = 23.25. It's only marginally more, because the main latency of the DB request is the network round-trip time.
The actual issue here is that a lookup needs to be performed at all. For every request, you need to pay the latency of one DB round-trip as well as maintaining code that does this lookup. And if you're going to do that anyway, why bother with this complexity of "stateless" tokens?
Re: Ask HN: What do you use for authentication and authorization?
#113Roll my own. Passwords are stored as bcrypt hashes. Just use plain old cookies to store session IDs.
Exactly! +1
Simplicity is also Security
Re: Ask HN: What do you use for authentication and authorization?
#114I'm mostly a backend developer (batch processing, systems integration etc) and it still amazes me there's no turney solution for different languages. I work in a large enterprise so we hook into our SSO for any kind of Auth for our web apps, though I haven't personally had to deal with this since my college days. If I remmebr.NET had something out of the box.
Anyways, when I dabbled a few years back, I uses stormpath but they closed down. Les Hazelwood, the creator or Apache Shiro works at Okta now... Which seems to provide enterprise security.
Can anyone comment on their experience with Shiro, or Okta in general, and if it would help OP.
Re: Ask HN: What do you use for authentication and authorization?
#115Edit: just read other comments pointing out the healthcare thing. Hire a professional.
Honestly, authentication is not that hard. There are many ways to do it, all with valid trade offs.
What you need to know is what your AUTHORIZATION story will be. Can anyone who can hit your API receive all data? Otherwise, you either need some kind of stateful access control or some kind of bearer token granting certain kinds of access. If the latter is simple enough for your use-case, then JWT, despite it's naysayers, might shine for you. Otherwise you can just use about anything since you'll be looking up what they can access in a DB anyway.
Re: Ask HN: What do you use for authentication and authorization?
#116Professionals. Hire an expert. If you can't answer these questions yourself (which is fine - it's specialized knowledge separate from the skillset needed for building a useful application), you are lacking critical competence for coding anything handling health information. The security minefield is much much bigger than the login page.
Classic hacker news. Ask for technical advice, get called incompetent.
If they asked a bunch of doctors how anesthesia worked, they were just about to go perform surgery at home, you'd expect the doctors to warn that it was a bad idea, no?
Re: Ask HN: What do you use for authentication and authorization?
#117Echoing the others telling you to hire a professional. If you have the money Okta has a professional services division that will set everything up for you. Use them. If you don't have the money us Auth.0. Don't try to handroll everything you will regret it.
Re: Ask HN: What do you use for authentication and authorization?
#118Earlier quoted context omitted.
Classic hacker news. Ask for technical advice, get called incompetent.
If they asked a bunch of doctors how anesthesia worked, they were just about to go perform surgery at home, you'd expect the doctors to warn that it was a bad idea, no?
I suppose there may be a distinction between asking "how does anaesthesia work?" and "should I perform surgery at home?".
Re: Ask HN: What do you use for authentication and authorization?
#119All new apps I’m building are based on password-less auth [1] & bearer token. NoPassword is just so much more comfortable than having to remember passwords. And boy, people are really bad at coming up with passwords - you might have seen it this Christmas at your parents’. [1] http://notes.xoxco.com/post/27999787765/is-it-time-for-passw...
This works only on devices for which you simultaneously have email access. For instance Netflix on a home gaming console would fail miserably using this schema. See also https://www.troyhunt.com/heres-why-insert-thing-here-is-not-...
Re: Ask HN: What do you use for authentication and authorization?
#120Earlier quoted context omitted.
You don't need JWT in this case. You can use a normal token with short expiry and some mechanism to keep it fresh as long as the user doesn't exit the application.
JWT is simpler to implement and more scalable than the sessionId approach so why would you use the more complex solution to get an inferior result? With JWT, you only need to do a single database lookup when the user logs in with their password at the beginning... You don't need to do any other lookup afterwards to reissue the token; just having the old (still valid but soon-to-expire) JWT in memory is enough of a ba…
I don't know what stack you're working with that makes you say re-issuing JWT every 50 seconds over WebSockets is simpler to implement than the session ID approach people have been using for 20+ years :)