4 ms·
A great reminder that, if you choose to roll your own auth, you need to handle a lot of edge cases. Timing attacks are not obvious and easy to forget protecting
by jrvarela56 4y ago
A great reminder that, if you choose to roll your own auth, you need to handle a lot of edge cases. Timing attacks are not obvious and easy to forget protecting against.
- clairity 4y agoyah, i ran across this article[0] that had some response time comparisons with the new authenticate_by feature in the upcoming rails 7.1 that mitigates a specific timing attack, which is what got me interested in seeing what the rails auth landscape looked like now. [0]: https://blog.kiprosh.com/rails-7-1-adds-authenticated_by/ https://blog.kiprosh.com/rails-7-1-adds-authenticated_by/
- Spivak 4y agoOutsourcing your auth suuuuuucks. It is such a pita when like the most critical service to uptime lives outside your control and so painful to switch. Don’t write your own, but also own it, and completely abstract it. Don’t let anything but a single file in a single shared library or service know anything at all about the underlying implementation.