3 ms·
Passport JS is horrible. Sure it's easy to use, but it's not secure, which is kind of the entire point. There are other libraries that are interesting, but tha
by imagist 10y ago
Passport JS is horrible. Sure it's easy to use, but it's not secure, which is kind of the entire point.
There are other libraries that are interesting, but that's more a function of necessity than of it being a good thing--people write JavaScript because it's the only thing that runs on the browser, and then people port it onto Node. And it's worth noting that a lot of these have been held back significantly by being on Node. Take Babel for example; it's useful and interesting, but the code is a mess because of callbacks, which makes it hard to modify, and it was taken down by the left-pad fiasco a few months back (which broke thousands and thousands of builds worldwide). Some interesting things have been built on Node, but that's despite Node, not because of Node, and they would be more reliable if they weren't built on Node.
- garysieling 10y agoYeah, that's fair. I can't say I've used it beyond prototyping, for which it is very easy. I came across it vs. doing something similar in C#, which required one library per vendor (Quickbooks OAuth, Google OAuth etc), and when I last used them I ran into issues where they conflicted so I like the combined interface approach.
- toupeira 10y agoIt's not really new though, see for example Omniauth for Ruby.
- mercer 10y agoCould you tell me more about Passport not being secure? I've been meaning to use it in an upcoming Node project, so I'd really love to know why I shouldn't use it, and what I should be using instead!
- imagist 10y agoJavaScript is missing some fundamental cryptographic primitives that make it impossible to write secure software with JS, most notably it lacks any cryptographically secure random number generator. Additionally, package installs are insecure, so unless you have time to audit the entire `node_modules/` you can't actually guarantee that the code you want to run is the code you have installed. Additionally, because JS doesn't have any namespace restrictions, a vulnerability in any package allows access to the whole codebase. For a survey of problems with JS (none of which have been fixed since this was written), take a look here: https://www.grc.com/sn/files/jgc-javascript-security.pdf https://www.grc.com/sn/files/jgc-javascript-security.pdf
- mercer 10y agoThanks for the info! Do popular Ruby and Python solutions suffer from the same problem?