3 ms·

Want to know what's crazy? I've stood up a bunch of services and stuff professionally over the last bunch of years, it's just that internal company tools always

Want to know what's crazy? I've stood up a bunch of services and stuff professionally over the last bunch of years, it's just that internal company tools always take care of deployment and security and authentication and exposing them to the world. Yay for efficiency and specialization. Boo for blind spots. Any recommended reading for biting the bullet?

munchbunny 7y ago
The specifics unfortunately depend a lot on what you're protecting. Are you writing an enterprise web app? Consumer web app? Phone app? Desktop app? Blog engine? E-commerce store? Multiple of the above?
- 6gvONxR4sf7o 7y ago
  How about just a simple personal project I want to only give access to myself and a few friends access to on browser and phone app? User X can access only documents ABC. Users must be logged in. I'm not looking to make a career shift to web dev, but I'd like to be able to build my own cheap toys, basically. While learning interesting and not terrible skills along the way.
  - ckrailo 7y ago
    Super scratch-notes version: - Use sendgrid to send emails, it'll be free at your usage - Make the login form only accept an email address, dont risk saving passwords, display a generic "if you signed up you'll get an email soon" message on submission for all values. - Whitelist your buddies' emails, send them a link to login with. Ignore the rest. - The link can be a UUID without the dashes or something similarly sufficiently random (could sha1 hash the time and be good enough for your purposes). yourdomain.com/login/somesufficientlyrandomandlongkey - Save that key in the DB, that's effectively the password. Delete stuff after a while so they have to re-login. Feel free to hit me up on Keybase or whatever (details in my profile) if you want to follow up in detail.

3 ms·

Want to know what's crazy? I've stood up a bunch of services and stuff professionally over the last bunch of years, it's just that internal company tools always

by 6gvONxR4sf7o 7y ago

munchbunny 7y ago
The specifics unfortunately depend a lot on what you're protecting. Are you writing an enterprise web app? Consumer web app? Phone app? Desktop app? Blog engine? E-commerce store? Multiple of the above?
- 6gvONxR4sf7o 7y ago
  How about just a simple personal project I want to only give access to myself and a few friends access to on browser and phone app? User X can access only documents ABC. Users must be logged in. I'm not looking to make a career shift to web dev, but I'd like to be able to build my own cheap toys, basically. While learning interesting and not terrible skills along the way.
  - ckrailo 7y ago
    Super scratch-notes version: - Use sendgrid to send emails, it'll be free at your usage - Make the login form only accept an email address, dont risk saving passwords, display a generic "if you signed up you'll get an email soon" message on submission for all values. - Whitelist your buddies' emails, send them a link to login with. Ignore the rest. - The link can be a UUID without the dashes or something similarly sufficiently random (could sha1 hash the time and be good enough for your purposes). yourdomain.com/login/somesufficientlyrandomandlongkey - Save that key in the DB, that's effectively the password. Delete stuff after a while so they have to re-login. Feel free to hit me up on Keybase or whatever (details in my profile) if you want to follow up in detail.