Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you protecting your staging environment(s) for your web apps?

news.ycombinator.com

Post reply on HN
Print view View original

1–7 of 7 posts

Ask HN: How are you protecting your staging environment(s) for your web apps?

#1

Post by summera »

By "staging environment" I'm referring to any non-production environment that you need to access over HTTPS, either ephemeral or long-living and potentially shared.

Are you using basic auth? If so, how are you managing usernames & passwords?

Are you using a VPN?

Are you using something else?

Re: Ask HN: How are you protecting your staging environment(s) for your web apps?

#3

Post by igorzij »

Typically the entire stack is copied so that you have the exact same setup, including auth, as in production. Basic auth isn't a great idea unless your production is using basic auth too. If you're using some federated login tool like Cognito or Auth0 then you can create smth like an isolated pool of users for each environment, forgot the exact name. VPN only needed if it's a compliance requirement, otherwise nothing wrong in having it public.

Re: Ask HN: How are you protecting your staging environment(s) for your web apps?

#4

Post by stephenr »

We use a cloudflare firewall, and then have a facility for users (i.e. "staff") to add themselves to the whitelist, via a tooling page for each env (which isn't behind the firewall, but does rely on http basic auth).

It's not perfect, but I think it works better than what it replaced (logic in the application and a shared 'secret' to access those environments)

Re: Ask HN: How are you protecting your staging environment(s) for your web apps?

#5

Post by summera »

igorzij wrote: post #3

Typically the entire stack is copied so that you have the exact same setup, including auth, as in production. Basic auth isn't a great idea unless your production is using basic auth too. If you're using some federated login tool like Cognito or Auth0 then you can create smth like an isolated pool of users for each environment, forgot the exact name. VPN only needed if it's a compliance requirement, otherwise nothing…

Totally agree with this sentiment in theory - it's best to keep the environments as similar as possible. But in practice there are requirements that will differ, such as having production be publicly available and staging be protected, mocking of certain third-party services that may not be available in a non-production environment, etc.
Post reply on HN