How Shopify implemented its secure authentication service
engineering.shopify.com
How Shopify implemented its secure authentication service
1–10 of 56 posts
Re: How Shopify implemented its secure authentication service
#2So is Shopify the biggest fish still on the Ruby stack?
Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.
Re: How Shopify implemented its secure authentication service
#3It’s not mentioned but I’m assuming that they built their own OIDC/OAuth backend and not use existing ones (eg okta, Auth0 etc).
It would be interesting to know the details of how they’re doing authorization. It appears that it’s all or nothing but I might be mistaken.
Re: How Shopify implemented its secure authentication service
#4So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.
IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..
Re: How Shopify implemented its secure authentication service
#5So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.
IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..
Pretty sure Stripe is a Ruby shop as well.
Re: How Shopify implemented its secure authentication service
#6It’s not mentioned but I’m assuming that they built their own OIDC/OAuth backend and not use existing ones (eg okta, Auth0 etc). It would be interesting to know the details of how they’re doing authorization. It appears that it’s all or nothing but I might be mistaken.
Running an OAuth2 server isn't tremendously involved. There are good open-source projects like https://github.com/ory/hydra that are pretty easy to configure.
Re: How Shopify implemented its secure authentication service
#7So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.
They’re still using a rails setup for their core services. But, this core falls over with him RPM. It’s failed in nearly all flash sales it has had to handle.
Rails is great. But commerce is heavy and I don’t believe Shopify can keep its existing core code base around much longer without a significant change to aid with performance.
Re: How Shopify implemented its secure authentication service
#8So is Shopify the biggest fish still on the Ruby stack? Nice article detailing how they did an upgrade to openId connect to allow SSO on multiple shops within a client company.
Funny you mention this. I just today had to implement a painful workaround for Shopify's insanely short timeout on product image uploads. On submitting an image url, you apparently get 4s to complete the whole transfer.
I found hundreds of people complaining about this in the community forums, going back years. If you're dynamically generating images, or on a congested network, 4s is far too short.
Since this is a simple config property, the only justification I can imagine is that they are trying to restrict the amount of time that their (single-threaded, memory-hungry) instances are occupied. Because of Ruby's poor resource management, a core part of their API is barely usable.
I'm pretty disappointed.
Re: How Shopify implemented its secure authentication service
#9It’s not mentioned but I’m assuming that they built their own OIDC/OAuth backend and not use existing ones (eg okta, Auth0 etc). It would be interesting to know the details of how they’re doing authorization. It appears that it’s all or nothing but I might be mistaken.
Running an OAuth2 server isn't tremendously involved. There are good open-source projects like https://github.com/ory/hydra that are pretty easy to configure.
Oh god, at megacorp we implemented our own OAuth2 stack. Much sadness ensued.
Re: How Shopify implemented its secure authentication service
#10Earlier quoted context omitted.
IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..
Pretty sure Stripe is a Ruby shop as well.
One of the biggest. They recently released Sorbet, a gradual type checker for Ruby.