11–20 of 105 posts
Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?
Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…
Why would any developer or engineer who has even an iota of consideration for privacy, web standards, and, indeed, humanity want to work for such a repugnant company as Facebook?
Because a lot of people aren't privileged enough to be able to quit their job on the spot.
The last two words of the title seem rather superfluous.
Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…
But, the TDD (Trend Driven Development) people won't agree with them. They want to work with those shiny trends for a shiny resume. JWT is horrible for the web, it need JavaScript, some needs Local Storage, which is worse than Cookies itself, and the revocation is complex.
Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…
Fixed that for you...
Original article from Dev.to: https://dev.to/simplelogin/if-you-care-about-user-privacy-do... I've recently implemented authentication for my project and I would just like to say to all the relatively amateur programmers out there: for web based authentication just stick with HTTPOnly SECURE cookies with DB backed sessions that you can revoke. The reason I'm saying this is that there's way too many posts talking abou…
I don't think that storing creds is suitable for newbies either. All authentication is complex and just using HTTPOnly and DB backend is not a solution at all.
Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should.
> just using HTTPOnly and DB backend is not a solution at all
My comment was not meant to be exhaustive and does not list all vulnerabilities. Just in context of some of the suggestions in the article. Using a mature framework like Django can protect you from other vulnerabilities CSRF, XSS, SQL Injection to some extent.