4 ms·
Just chiming in that I appreciate this resource. A lot of security advice is esoteric and sometimes feels ridiculous. Like a lawyer who advises you not to do an
by zoogeny 2y ago
Just chiming in that I appreciate this resource. A lot of security advice is esoteric and sometimes feels ridiculous. Like a lawyer who advises you not to do anything ever. This guide was refreshingly concise, easy to follow and understand, and has good straight forward advice.
I'll keep an eye on these comments to see if there are any dissenting opinions or caveats but I know I'll be reviewing this against my own auth projects.
One thing I would like to see would be a section on JWT, even if it is just for them to say "don't use them" if that is their opinion.
- kmoser 2y agoI would have liked to see a section on SAML and a high-level overview of how to implement it.
- slieschke 2y agoThere's an issue tracking that at https://github.com/pilcrowOnPaper/copenhagen/issues/3 https://github.com/pilcrowOnPaper/copenhagen/issues/3
- grinich 2y agowe at workos wrote about it here: https://workos.com/blog/the-developers-guide-to-sso https://workos.com/blog/the-developers-guide-to-sso
- stult 2y ago> Like a lawyer who advises you not to do anything ever. One of my most frequent criticisms of teams responsible for security is that they spend a lot of time telling people what not to do instead of proactively providing them with efficient tools or methods for doing what they want to do.
- GoblinSlayer 2y agoI'd recommend email flow like email verification and password reset to last for several days if the secret token is strong enough. Email can be seen as a more secure system, so it may not be available immediately and everywhere.