3 ms·

So what's exactly the use case for this? I'm not entirely sure. Let's say I deploy it. Users of whatever service I provide use this to login to Google, Twitter

So what's exactly the use case for this? I'm not entirely sure. Let's say I deploy it. Users of whatever service I provide use this to login to Google, Twitter, etc, then what? do I need to also implement something on the servers I'm protecting behind a login? I.e. some "verification" method that checks whether the client's JWT tokens are valid so I can grant them access?

fitz2001 9y ago
It's helpful if you want your website/webapp to support login with X (Google, Facebook, etc). Your services on the same domain can than use these credentials and eventually use the respective API's with the per-user key. All you need to do is: a) get key/secret for the respective service b) deploy this microservice with the respective env variables
- saganus 9y ago
  Aha. So it protects the service via protecting the domain itself, right? I'll have to give it a try.
- usea 9y ago
  This kind of explanation would be really useful on the website. Right now it has nothing to describe what it is/does.
  - aisofteng 9y ago
    The explanation you replied to didn't say anything I didn't find obvious from the tag line.
nielsole 9y ago
"On successful login two cookies will be created: jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only! profile - A JSON string which containing non-sensitive information (accessible from browser JS): username - string / mandatory, the account specific user alias (e.g. Twitter name) - photo - string / optional, the account specific user image link name - string / optional, the "real" name " This looks like just enough rope to hang oneself. If you check only the profile variable it could easily be set by the user herself. So I guess you need to check the jwt. I guess it makes more sense if this would be run as reverse proxy so the cookies can't be tampered with.
- transitorykris 9y ago
  The JWT is signed (see LW_JWT_SECRET env variable), you'll want to check the signature before trusting the rest of the contents.
_ao789 9y ago
Pet gripe: don't say "JWT tokens", it's just "JWT". That's what the T stands for..
- saganus 9y ago
  True. It's a bad habit I guess.

fitz2001 9y ago

It's helpful if you want your website/webapp to support login with X (Google, Facebook, etc). Your services on the same domain can than use these credentials and eventually use the respective API's with the per-user key. All you need to do is: a) get key/secret for the respective service b) deploy this microservice with the respective env variables

saganus 9y ago
Aha. So it protects the service via protecting the domain itself, right? I'll have to give it a try.
usea 9y ago
This kind of explanation would be really useful on the website. Right now it has nothing to describe what it is/does.
- aisofteng 9y ago
  The explanation you replied to didn't say anything I didn't find obvious from the tag line.

nielsole 9y ago

"On successful login two cookies will be created: jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only! profile - A JSON string which containing non-sensitive information (accessible from browser JS): username - string / mandatory, the account specific user alias (e.g. Twitter name) - photo - string / optional, the account specific user image link name - string / optional, the "real" name " This looks like just enough rope to hang oneself. If you check only the profile variable it could easily be set by the user herself. So I guess you need to check the jwt. I guess it makes more sense if this would be run as reverse proxy so the cookies can't be tampered with.

transitorykris 9y ago
The JWT is signed (see LW_JWT_SECRET env variable), you'll want to check the signature before trusting the rest of the contents.

_ao789 9y ago

Pet gripe: don't say "JWT tokens", it's just "JWT". That's what the T stands for..

saganus 9y ago
True. It's a bad habit I guess.