Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Satellizer – Authentication for AngularJS

github.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Show HN: Satellizer – Authentication for AngularJS

#31

Post by sahat »

nobullet wrote: post #22

I wonder: why Java and Spring? Do you consider other Java implementations?

I have considered Play Framework and Dropwizard. Play it seems is better suited for Scala language and I don't know much about real-world usage of Dropwizard. Between Struts and Spring, Spring seems to have a more active community. I haven't done anything with the Java example yet so Spring can easily swapped for something else if you think that other framework is better. I am not a Java developer so I need someone's help on this one.

Re: Show HN: Satellizer – Authentication for AngularJS

#32

Post by sahat »

filearts wrote: post #15
pingburg wrote: post #13

This is very helpful. How about handling validation and errors (e.g. unique account)?

It seems like a lot of this heavy lifting is left to api / backend implementors and is not explicitly addressed. I don't think that is a short-coming of the module but perhaps some additional documentation on best practices could be helpful.

@pingburg @filearts You are right, unique account validation and error handling belong to the server. What Satellizer can do is catch an error through the $auth.authenticate().catch() promise and display it to the user. I will definitely update the documention very soon. The README of https://github.com/sahat/hackathon-starter could fit on a screen when I first posted it on Hacker News earlier this year; it is now 1300+ lines long.

Re: Show HN: Satellizer – Authentication for AngularJS

#33

Post by sahat »

bmelton wrote: post #17

So, how would this work if I'm using Python-Social-Auth as the provider as an interface to Django? Most sites implementing social auth don't do it in the client directly, but as an interface to the oauth and then just trusting that authentication as canon, while simultaneously invoking a non-oAuth login() method at the tail end of the oAuth login. Not sure how this relates directly. That said, this is a FANtastic, an…

Satellizer is designed to be used without auth libraries such as Passport (Node), OmniAuth (Ruby). On Python-side all you need is the requests library. It is so by design to avoid relying on third-party libraries. Additionally, if I were to implement it with a server-side auth library there is no choice but to use full page redirects, i.e redirect to Facebook, authorize the app, redirect back to the app.

Re: Show HN: Satellizer – Authentication for AngularJS

#34

Post by bmelton »

sahat wrote: post #33
bmelton wrote: post #17

So, how would this work if I'm using Python-Social-Auth as the provider as an interface to Django? Most sites implementing social auth don't do it in the client directly, but as an interface to the oauth and then just trusting that authentication as canon, while simultaneously invoking a non-oAuth login() method at the tail end of the oAuth login. Not sure how this relates directly. That said, this is a FANtastic, an…

Satellizer is designed to be used without auth libraries such as Passport (Node), OmniAuth (Ruby). On Python-side all you need is the requests library. It is so by design to avoid relying on third-party libraries. Additionally, if I were to implement it with a server-side auth library there is no choice but to use full page redirects, i.e redirect to Facebook, authorize the app, redirect back to the app.

Thanks a million for the response. I think that's appropriate, but I've found sort of a hybrid solution that I was already working on before satellizer came out, incorporating a fix that looks vaguely like this:

https://github.com/omab/python-social-auth/issues/68

That said, I'm working through piecing that together with satellizer, and I wanted to give you a huge thanks for including the server examples in so many languages, which ought to be of use.

Re: Show HN: Satellizer – Authentication for AngularJS

#35

Post by sahat »

eric_bullington wrote: post #28

This is a very, very nice project -- almost enough to pull me back from ReactJS back to AngularJS. Almost. One question: they say it can be adapted to any Oauth1 or 2 provider, but doesn't the Oauth 2 provider have to support the Implicit Flow for this type of client-side app to work? If so, is it true that Github doesn't support Implicit flow? (this is what I've read, and I've not found much on the web otherwise abo…

Satellizer gives you an illusion that you're doing an implicit grant flow by opening a popup and then magically you are signed-in. But authorization process is handled on the server: https://github.com/sahat/satellizer/blob/master/examples/ser...

I just implemented a GitHub sign-in and it took me only 8 minutes because on the server it was mostly copy-&-paste of the Facebook sign-in and on the client it's just:

  $authProvider.oauth2({
    name: 'github',
    clientId: 'xxxxxx',
    url: '/auth/github',
    authorizationEndpoint: 'https://github.com/login/oauth/authorize',
    redirectUri: window.location.origin
  });
Thank you. I like React too so perhaps someone could implement something like Satellizer that integrates with React.

Re: Show HN: Satellizer – Authentication for AngularJS

#36

Post by eric_bullington »

sahat wrote: post #35
eric_bullington wrote: post #28

This is a very, very nice project -- almost enough to pull me back from ReactJS back to AngularJS. Almost. One question: they say it can be adapted to any Oauth1 or 2 provider, but doesn't the Oauth 2 provider have to support the Implicit Flow for this type of client-side app to work? If so, is it true that Github doesn't support Implicit flow? (this is what I've read, and I've not found much on the web otherwise abo…

Satellizer gives you an illusion that you're doing an implicit grant flow by opening a popup and then magically you are signed-in. But authorization process is handled on the server: https://github.com/sahat/satellizer/blob/master/examples/ser... I just implemented a GitHub sign-in and it took me only 8 minutes because on the server it was mostly copy-&-paste of the Facebook sign-in and on the client it's just: $auth…

Thanks for the explanation.

>I like React too so perhaps someone could implement something like Satellizer that integrates with React.

Indeed. And such a project could still make use of the server code of Satellizer, I'd imagine.

Re: Show HN: Satellizer – Authentication for AngularJS

#38

Post by dmix »

evilsnake wrote: post #37

I may be paranoid, but is there any security concern about doing authentification on the frontend ? Wouldn't the user be able to see exactly what is going on and intercept some sensitive information ?

Client-side token based authentication is pretty well used and tested. It's even being standardized as JWT (JSON Web Token):

http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

Additionally, there are quite a few benefits to using Token auth over cookie-based auth as well, such as not having to worry about CRSF protection:

https://auth0.com/blog/2014/01/07/angularjs-authentication-w...

I'd say cookies have a greater risk of being intercepted and hijacked than a token-based system.

But every implementation has flaws even if the underlying concept has been vetted. But if you're protecting sensitive information, it's always good to hire a security expert to test your systems.

Post reply on HN