colinclerk

13 ms·

61.
by colinclerk 5y ago
Yet :) Indeed, we're still catching up on feature-completeness, especially for the B2B world. In 2022 we will be tackling organization onboarding, SAML SSO, roles and permissions, subscription management, and authorization (as it relat
62.
by colinclerk 5y ago
For multiple services, we've been seeing more and more services adopt JWT-based models for SSO. We have a Hasura integration where we'll generate the JWT necessary for authenticating queries: https://docs.clerk.dev&#x2
63.
by colinclerk 5y ago
Disclosure: founder of clerk.dev I'm interested in why FusionAuth chose OAuth to share identity between localhost:${serverPort} and localhost:${fusionAuthPort}? Auth0 does the same, and it's always struck me as misplaced. OAuth m
64.
by colinclerk 5y ago
Safari - for better or worse - is setting the standard for many privacy updates, especially around 3rd party cookies and tracking. Those updates broke a lot of websites - you might have noticed SSO failing, iframes failing, or websites conf
65.
by colinclerk 5y ago
Server Components make server-side rendering wayyyyy easier for React developers. With SSR today, developers need to take a `request` object and preload all the data necessary to render the page _before_ any component logic runs. This is a
66.
by colinclerk 5y ago
Hey everyone - Clerk cofounder here. We're frequent readers of HN ourselves and have enjoyed the spirited debate about stateless-vs-stateful auth over the years. The consensus we reached is that stateless auth is good, but the amount o
67.
Show HN: Stateless and revocable session management, as-a-service(clerk.dev)
8 points by colinclerk 5y ago|1 comments
68.
by colinclerk 5y ago
It's really incredible. We've come to think of it as "pre-authentication" vs "just-in-time authentication." The hard work of generating the JWT is done in the background, out of the critical path, so the reques
69.
by colinclerk 5y ago
Hey HN! This is an exciting launch for us - it's the first time we're really showing off our new stateless authentication mechanism. The debate of stateless JWTs vs stateful auth is well-storied on HN, and we frequently checked th
70.
by colinclerk 5y ago
Congrats on the launch! There’s a strong shift of devtools from the backend to the frontend, and services are often jumping through hoops to 1) remain secure, and 2) allow client-only integration. For example, Stripe offers a client-only in
71.
Generating Sortable Stripe-Like IDs with Segment's KSUIDs(clerk.dev)
2 points by colinclerk 5y ago|0 comments
72.
by colinclerk 5y ago
> Since it’s common for subdomains to host other applications that may have their own security concerns, ditching CSRF tokens for Lax cookies may not be a wise step! This is a really fantastic point, and it applies to CORS as well. It&#x
73.
by colinclerk 5y ago
> The trick is to only allow logins from users that are carrying at least one cookie which you have set in that way—since you know that those cookies could not have been sent if the user originated in a form on another site. It's c
74.
by colinclerk 5y ago
I'm a cofounder of https://clerk.dev and we've found we need to keep a close eye on this ever-evolving world of browser security models. I think what OP has glazed over a little bit, is that authentication is a massive
75.
by colinclerk 5y ago
As a counterpoint here, email- or sms-based passwordless flows can be quite slow to complete. We (clerk.dev) are seeing ~35 seconds for passwordless, ~8 for passwords, ~5 for Social Sign In: https://www.clerk.dev/blog/
76.
by colinclerk 5y ago
We actually have a PR in review to fix this if you're using a password manager: https://user-images.githubusercontent.com/1811063/121708843-... We put a hidden field on the page to accept a password from a passwo
77.
Designing fast sign in forms – diving into the data(clerk.dev)
7 points by colinclerk 5y ago|2 comments
78.
by colinclerk 5y ago
> but less hard than it ever has been before I have a very vested interest in this (founder Clerk.dev) - but the exact opposite experience is what led us to start Clerk. Auth was easy when it was just email verification and choosing the
79.
by colinclerk 5y ago
Yes, unfortunately you've picked the wrong issue to be scared about. The CSRF attacks you're describing have been solved by browsers with the SameSite attribute on cookies. If you set SameSite=Lax or SameSite=Strict, cookies will
80.
by colinclerk 5y ago
Your application should certainly have some resolution to an account being hacked or a session token being stolen. No expiry and no denylist means an attacker can cause problems until you patch your code.
81.
How HttpOnly cookies help mitigate XSS attacks(clerk.dev)
2 points by colinclerk 5y ago|0 comments
82.
by colinclerk 6y ago
I think the edge compute trend is cycling developers away from CORS again. The old server-rendered frameworks (rails, django) never really needed CORS because frontend and backend were on the same origin. Then lots of CORS issues cropped up
83.
by colinclerk 6y ago
It used to be, and that's why web frameworks included a CSRF token with all write requests. Without the CSRF token (which a third party couldn't have), the write would be stopped. In modern browsers, the CSRF token isn't nece
84.
by colinclerk 6y ago
The SameSite cookie policy doesn't offer fine-grained control like CORS. So, if you want to allowlist cookies for certain third-party origins but not all, CORS would be a better option. In practice, most sites want to prevent all cros
85.
by colinclerk 6y ago
This is what inspired me to look into true JIT: https://news.ycombinator.com/item?id=26731816
86.
by colinclerk 6y ago
I've started investigating whether a truly "just in time" variant of Tailwind is reasonable. It's almost like a CSS transpiler - converting tailwind classnames to their CSS form. You'll probably always want AOT for
87.
by colinclerk 6y ago
Sorry about that, I think I cluttered my response by talking about the client-side use case. Does anybody use ETL-for-marketers tools to extract User data from one source, then load it into Stripe as Customer objects? I don't think it&
88.
by colinclerk 6y ago
Because they don't know confidently which user is logged in. A lot of the marketing tools rely on insecure signals, like a userID passed directly from javascript. If you want to trigger actions rather than observe them, you need a secu
89.
by colinclerk 6y ago
Third party integrations
90.
by colinclerk 6y ago
My take on this is a little different. (Disc: I'm a cofounder of Clerk which is also in the space) I think Okta will try to build "Okta for Customer ID" When people think of Okta, they think of it as a tool to help employees

More ›