HelloJS – Client-side OAuth for JS • Hacker News Board

Re: HelloJS – Client-side OAuth for JS

#11

Post by reubano » Thu, Sep 11, 2014, 6:09 AM UTC

plingamp wrote: post #10

Very interesting project! Can you explain what some of the differences are between this library and PassportJS?

Passport is sever and side meant for use with nodejs [1]. This is client side for use with bower [2].

[1] http://nodejs.org/ [2] http://bower.io/

Re: HelloJS – Client-side OAuth for JS

#12

Post by reubano » Thu, Sep 11, 2014, 6:12 AM UTC

drcode wrote: post #4

adodson wrote: post #2

Thanks for sharing my project HelloJS

Hi... thanks for writing this. As a newb on these sorts of issues, I have some questions: 1. So this is 100% client side... Why do I see "npm" in the instructions? Isn't that connected to nodejs? What if I'm writing a java web server app, will this still work, or does it need to talk to a nodejs server somehow? 2. I take it none of this hits a third party server (i.e. your server)? 3. How do I get the user's info obt…

1. NPM is used for installing bower [1], a package manager for client side libraries.

[1] http://bower.io/

Re: HelloJS – Client-side OAuth for JS

#13

Post by reubano » Thu, Sep 11, 2014, 6:17 AM UTC

Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.

Re: HelloJS – Client-side OAuth for JS

#14

Post by adodson » Thu, Sep 11, 2014, 6:18 AM UTC

plingamp wrote: post #10

Very interesting project! Can you explain what some of the differences are between this library and PassportJS?

PassportJS = NodeJS authentication, designed for single sign-on.

HelloJS = Browser + Phonegap authentication and API request handling designed to interact with thirdparty services from the client app.

Re: HelloJS – Client-side OAuth for JS

#15

Post by adodson » Thu, Sep 11, 2014, 6:27 AM UTC

j-rom wrote: post #9

This looks amazing. Are you planning on adding any other services?

Yes, but its a pretty arduous task digesting and implementing API docs. That pain was the impetus to standardize them into the HelloJS library.

Re: HelloJS – Client-side OAuth for JS

#16

Post by pr0filer__ » Thu, Sep 11, 2014, 7:16 AM UTC

reubano wrote: post #13

Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.

From my understanding this is also the case ie. don't do OAuth client (end-user/browser) side.

Re: HelloJS – Client-side OAuth for JS

#17

Post by egeozcan » Thu, Sep 11, 2014, 8:05 AM UTC

pr0filer__ wrote: post #16

reubano wrote: post #13

Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.

From my understanding this is also the case ie. don't do OAuth client (end-user/browser) side.

If the client passes the server a token which the server can verify against the third-party service providing the login, I don't see a reason not to trust the client. I'm very interested to hear what kind of security problems this could bring - if they can be mitigated, using this library would be very convenient for some projects.

Re: HelloJS – Client-side OAuth for JS

#18

Post by ishi » Thu, Sep 11, 2014, 8:19 AM UTC

This looks pretty awesome. Could it be used for importing email contacts from gmail/yahoo/live etc.?

Re: HelloJS – Client-side OAuth for JS

#19

Post by hackthisuk » Thu, Sep 11, 2014, 8:46 AM UTC

reubano wrote: post #13

Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.

Using client-side script to restrict access is a big no from a security stand point. From what I have read this library is intended to interact with third party services rather than for access. E.g. pulling in photos, contacts etc

Re: HelloJS – Client-side OAuth for JS

#20

Post by laurent123456 » Thu, Sep 11, 2014, 8:47 AM UTC

reubano wrote: post #13

Hmm, I don't see any mention of security. I can't find the source, but I remember reading that if you wanted to restrict access to certain pages on your site to authenticated users in a single page app it was more secure to do it server side. Security experts feel free to chime in.

Assuming OAuth uses random numbers (don't remember if it does), one issue could be that the RNG of Javascript is not cryptographically secure. I'd be interested to hear the opinion of a security expert too.