4 ms·
Agree with most of this, but not sure about a few points here: > Don't build your CI/CD pipelines; use Vercel or something similar Why wouldn't you build your
by Zetice 3y ago
Agree with most of this, but not sure about a few points here:
> Don't build your CI/CD pipelines; use Vercel or something similar
Why wouldn't you build your own CI/CD pipelines early? It's kind of trivially easy to do early on, and in my experience won't really change until/unless you want it to.
> Don't use message queues, crons and anything that can by design cause race conditions until absolutely unavoidable
Message queues are not universally the cause of race conditions, you just have to accept the eventually-correct nature of the resulting system. If you know how to handle that, you're fine.
> Forget using JWTs if you're in some sort of regulated field. Any sensible white/greybox certification for insurance (and that's often a requirement for running a business) will require you to have "log out all devices" option.
JWTs didn't stop us from getting SOC Type I and II certified, or prevent us from getting insurance, not sure what you mean by this. I guess we're not in a "regulated field" but if you aren't, JWTs are great.
- AntonCTO 3y ago> JWTs didn't stop us from getting SOC Type I and II certified, or prevent us from getting insurance, not sure what you mean by this. What he probably means is that JWT can't be invalidated on its own like you can with a session. But of course it can be done in a similar way, and some products support it. You just lose some of the benefits of JWT. (Let alone the ability to negotiate the logout time span).
- Zetice 3y agoYeah, I just think folks overestimate the value of a "log out of all devices" button. Short TTLs on session tokens seem fine enough for the early months, at least, and then yeah once you can get that first round of funding (or revenue to pay for the lights), getting something like auth0 might make more sense.
- gpjanik 3y agoI agree with you, but that's one of the things that will have to be rewritten if you're in a regulated business - unless you go for some hybrid "JWT but stored in the database" which is, basically, not a JWT.
- SgtBastard 3y agoA JWT with a sid claim that RPs use to check session validity is 100% still a JWT with bearer authz claims.
- gpjanik 3y agoYou can start storing JWTs in the database to regain control over their validity, but then you fundamentally have sessions, just done in an unnecessarily complex way. It goes back to some Xbox vs. Playstation/Android vs. iOS type of argument here, but JWTs _as a stateless token_ (as most people would use them) are just not suitable for the job if you're in a business that requires good security practices. I wrote that point specifically because rewrite of authentication in the middle of product building just to get certified/approved by pentesters is a horrible experience. Using auth0 or Okta or whatever software that handles it for you is probably advised as the person above wrote.
- gpjanik 3y agoRe: CI/CD - if you want to have: - Multiple environments - History of deployments accessible at hand - Management of environmental variables/other configs etc. You're going to spend time on something that's available off-shelf. I don't believe it's either trivial or less error-prone than using any existing service. Re: message queues: Yes, but you may also just not use them and then not have to consider that complexity. Again, if necessary, use, if not, don't. Write boring, synchronous code if you can. Everything in the world is "fine if you know how to use it", but you can dedicate your energy elsewhere.