3 ms·
How does one go about getting authentication like this working in a development environment?
by scwoodal 8y ago
How does one go about getting authentication like this working in a development environment?
- nzoschke 8y agoI do JWT token auth for apps as documented here: https://github.com/nzoschke/gofaas/blob/master/docs/security-cors-jwt.md https://github.com/nzoschke/gofaas/blob/master/docs/security... In dev I run the same exact code and copy the JWT cookie from my production site. Both dev and prod have the same secret to validate the cookie.
- mkarazin 8y agoYou probably are well aware, but security wise that's a huge issue. If it's a hobby app, okay, but anything with actual users should separate keys. The main concern would be that dev keys are not considered secure and anyone with access to the dev key could then impersonate any other user of the production application.
- scwoodal 8y agoI wouldn't want to share keys like that. I'd also lose out on being able to modify my test account(s) with different groups/permissions that might not be in production yet.