jfroma

26 ms·

1. 241.▲
   by jfroma 12y ago

   Thanks for reporting this! I just open an issue here: https://github.com/jsonwebtoken/jsonwebtoken.github.io/issue...
2. 242.▲
   by jfroma 12y ago

   Yes, this is a real problem, tokens can get very large if you put too much information. HTTP does not define any limit for headers, but most of the Web Servers have a default limit, Apache 8kb, IIS 16kb, nginx 4kb (see this question on SO [
3. 243.▲
   by jfroma 12y ago

   Yes, it is a bad UX that the session expire randomly and how to handle this is a whole subject per se. Here are my two cents: - Web Apps: If you set an expiration of 1 week, do not use the token for 1 week. Use it for a day and then use the
4. 244.▲
   by jfroma 12y ago

   Store the token on a cookie or localstorage (see store.js for instance).
5. 245.▲
   Token-based Auth for Git Servers(auth0.com)

   1 points by jfroma 12y ago|0 comments
6. 246.▲
   by jfroma 12y ago

   Basically the vulnerability is in the facebook side. Every oauth provider has a list of "allowed redirect uris", a good oauth provider will check the entire url, but facebook doesn't check the query string in the url. If you
7. 247.▲
   by jfroma 13y ago

   The [OWASP] recommended approach to solve CSRF is with a Synchronizer Token [1]. Basically render a token with a hidden input with your form associated with the user session and as you mention use a middleware to validate the token on every
8. 248.▲
   by jfroma 13y ago

   thanks, glad it helped!
9. 249.▲
   by jfroma 13y ago

   No, you need the signed token for the link, that will only works for that particular url (protocol, host, path, query), for a breve period of time and only for GETs. As mentioned in the blog post, you can check hawk bewits: https:/&#x
10. 250.▲
    by jfroma 13y ago

    in addition to our first blog post: http://blog.auth0.com/2014/01/07/angularjs-authentication-wi... Jose Paddilla is using it with django and he wrote a blog post: http://jpadilla.com/post&#x2
11. 251.▲
    by jfroma 13y ago

    In case you missed, this is a follow up of our first blog post: http://blog.auth0.com/2014/01/07/angularjs-authentication-wi... and http://blog.auth0.com/2014/01/15/auth-with-so
12. 252.▲
    by jfroma 13y ago

    I've tried this and it is not that easy, docker containers are meant to run one and only one process. So, for instance my puppet started an upstart job, and this crashes the docker build process. I'm a docker newbie, though.