3 ms·

Pretty sure this is meant for prototyping and maybe demoing in controlled environments. As soon as you involve auth, things get boring and annoying.

throw_m239339 5y ago
> As soon as you involve auth, things get boring and annoying. No, JWT is easy enough to implement.
- Spivak 5y ago
  JWT is crazy annoying compared to "pass an API key" in the header.
  - notsureaboutpg 5y ago
    It really isn't. There are off the shelf libraries and you can keep JWTs alive forever. You don't have to do refresh tokens, etc. Bare minimum JWT implementation is easy.
  - throw_m239339 5y ago
    > JWT is crazy annoying compared to "pass an API key" in the header. An API key and a JSON WEB TOKEN have a completely different purpose. API keys don't solve authorization. A single JWT provider can authorize many different servers. Furthermore Go already have several good JWT libraries.
    - Spivak 5y ago
      And JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine.
      - throw_m239339 5y ago
        > And JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine. Re-read the OP > Unfortunately, to do anything complicated, you will need to write server-side queries that verify that the user is allowed to do what they are trying to do. this is authorization, not authentication. Your assertion is false at first place. Your comment makes no sense by the way. You'd have the exact same issue with another authorization scheme, the credentials need to come from somewhere. There no such thing as "prototyping servers" in the wild. Only blatantly unsecure open source servers.
    - aabbcc1241 5y ago
      For demo application, there maybe only one user
gwbas1c 5y ago
Honestly, anything simple. It could be as brain-dead simple as passing a password on the command-line, and then requiring the password as a header.
- brazzledazzle 5y ago
  As much as I hate saying it even a simple token in a url parameter might be ok for a prototype.

throw_m239339 5y ago

> As soon as you involve auth, things get boring and annoying. No, JWT is easy enough to implement.

Spivak 5y ago
JWT is crazy annoying compared to "pass an API key" in the header.
- notsureaboutpg 5y ago
  It really isn't. There are off the shelf libraries and you can keep JWTs alive forever. You don't have to do refresh tokens, etc. Bare minimum JWT implementation is easy.
- throw_m239339 5y ago
  > JWT is crazy annoying compared to "pass an API key" in the header. An API key and a JSON WEB TOKEN have a completely different purpose. API keys don't solve authorization. A single JWT provider can authorize many different servers. Furthermore Go already have several good JWT libraries.
  - Spivak 5y ago
    And JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine.
    - throw_m239339 5y ago
      > And JWT's don't solve authentication which was the actual problem people were looking to solve. For a prototyping server authn==authz is more than fine. Re-read the OP > Unfortunately, to do anything complicated, you will need to write server-side queries that verify that the user is allowed to do what they are trying to do. this is authorization, not authentication. Your assertion is false at first place. Your comment makes no sense by the way. You'd have the exact same issue with another authorization scheme, the credentials need to come from somewhere. There no such thing as "prototyping servers" in the wild. Only blatantly unsecure open source servers.
  - aabbcc1241 5y ago
    For demo application, there maybe only one user

gwbas1c 5y ago

Honestly, anything simple. It could be as brain-dead simple as passing a password on the command-line, and then requiring the password as a header.

brazzledazzle 5y ago
As much as I hate saying it even a simple token in a url parameter might be ok for a prototype.