3 ms·
At a minimum, this should be password protected by default. One of the security lessons from the late 1990s and early 2000s is that things like this quickly ge
by gwbas1c 5y ago
At a minimum, this should be password protected by default.
One of the security lessons from the late 1990s and early 2000s is that things like this quickly get hacked. Many developers forget that a service where all security is handled client-side are easy targets for hacking.
Furthermore: In a lot of cases, people will ship prototypes and run their stuff on top of them long after they have outgrown a critical component.
I have tried to write a universal backend... It's possible, but you really have to work in a permissions model from the beginning. What you'll find is that basic read/write/own enables very basic functionality. Unfortunately, to do anything complicated, you will need to write server-side queries that verify that the user is allowed to do what they are trying to do.
- btbuildem 5y agoPretty sure this is meant for prototyping and maybe demoing in controlled environments. As soon as you involve auth, things get boring and annoying.
- throw_m239339 5y ago> As soon as you involve auth, things get boring and annoying. No, JWT is easy enough to implement.
- Spivak 5y agoJWT is crazy annoying compared to "pass an API key" in the header.
- notsureaboutpg 5y agoIt really isn't. There are off the shelf libraries and you can keep JWTs alive forever. You don't have to do refresh tokens, etc. Bare minimum JWT implementation is easy.
- throw_m239339 5y ago> JWT is crazy annoying compared to "pass an API key" in the header. An API key and a JSON WEB TOKEN have a completely different purpose. API keys don't solve authorization. A single JWT provider can authorize many different servers. Furthermore Go already have several good JWT libraries.
- Spivak 5y agoAnd JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine.
- throw_m239339 5y ago> And JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine. Re-read the OP > Unfortunately, to do anything complicated, you will need to write server-side queries that verify that the user is allowed to do what they are trying to do. this is authorization, not authentication. Your assertion is false at first place. Your comment makes no sense by the way. You'd have the exact same issue with another authorization scheme, the credentials need to come from somewhere. There no such thing as "prototyping servers" in the wild. Only blatantly unsecure open source servers.
- aabbcc1241 5y agoFor demo application, there maybe only one user
- gwbas1c 5y agoHonestly, anything simple. It could be as brain-dead simple as passing a password on the command-line, and then requiring the password as a header.
- brazzledazzle 5y agoAs much as I hate saying it even a simple token in a url parameter might be ok for a prototype.