21–30 of 58 posts
Thanks for sharing.
Thanks for sharing my project HelloJS
Hi, thanks for putting this together and releasing it. I'd like to use it on our corporate intranet, but we use the OAuth2 implicit flow with JSON web tokens. Does hello.js support this use case?
Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.
Google(+?) requires you to whitelist possible redirect URLs, meaning that it's much more obvious what happens after a redirect. Thus limiting what an attacker may do...
Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.
Assuming OAuth uses random numbers (don't remember if it does), one issue could be that the RNG of Javascript is not cryptographically secure. I'd be interested to hear the opinion of a security expert too.
Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.
It's not it was more secure,it's that it is impossible to secure anything on the client(native or html,by the way) if there is no interaction with a server doing access control somehow. That one reason why old facebook app was downloading HTML instead of having it bundled and just requesting json payloads).
What is a single page app? a single HTML file.How can you secure anything in a single HTML file? there are no "pages", the browser history is just tricked into pushing or poping url states.
You can however decide that an API call will fetch resources like js and css right after a user is logged in,but that's the server doing its job,and the assets would be served either through tokenized temporary URLs , or read on the server's disk , streamed through a server-side language then dumped in the client.
I bet that a majority of SPAs out there dont do that,and sensitive assets are downloadable even when a user isnt logged in.
A non authorized user shouldnt have accessed to these assets,or even endpoint URLs meant for authorized users.But yeah,it means using a proper server-side language and not just serving everything from S3.
Very interesting project! Can you explain what some of the differences are between this library and PassportJS?
PassportJS = NodeJS authentication, designed for single sign-on. HelloJS = Browser + Phonegap authentication and API request handling designed to interact with thirdparty services from the client app.
This looks pretty awesome. Could it be used for importing email contacts from gmail/yahoo/live etc.?
What could possibly go wrong? ;)