« first day (2768 days earlier)      last day (2404 days later) » 

20:01
you want all secrets stored server side, any client side data is vulnerable
i guess im confused about how that distinction is made
like isnt node.js considered not client-side
yeah node js is for servers
im just dumb about this stuff
typically you have a bundle of client side java script like react (or alternatively an app) that works with your API
so if i call a .js endpoint hosted in the public folder (think same level as index.html) is it considered client or server
20:04
the javascript isn't viewable, just what is returned in the response
again sorry if it sounds dumb i dont understand all of this yet
assuming you're doing it correctly
so that js file could have the client hardcoded in it and thatd be safe
you don't want to serve javascript for the browser to run
again assuming its done correctly
20:05
yeah that could be fine
what do you mean by that?
you don't want to serve javascript for the browser to run
node.js doesn't need a public folder (if your server has a public folder, don't put secrets in it, it might be accessible over the internet)
node lets you use js like you would use bash or python
basically you have your server node.js server and your react bundle (runs in browser)
Write a script, run it locally
Or bundle it up like dave said
you don't want to store the secret in the react bundle, you want it in the server
because the browser has the entirety of the front end javascript
but it doesn't have the code that processes API requests and returns responses
20:06
Does he really need frontend? A swap could be purely backend code just returning the new token
He shouldn't need react and all. Just a simple nodejs script will suffice
currently im using firebase functions
yeah if it's backend that's fine. I'm clarifying what the concern is
its basically just lambdas
for everything and its fine
20:07
If it works, why shift it?
you shouldn't need to worry about it then
but i was just curious about doing it hosted
Is your time worth the pennies the functions cost?
20:07
but for my own like
experience/growth id like to know how to do both
removes JMR from slave labour list
javascript is just a language
cause like functions are obviously not client facing
so you can do whatever there safely
Normally, we use it inside webpages, which exposes it to clients
nodejs lets you run it server side
cause like if i did swap.php for instance
And then push only in your response
20:08
thats going to be secure
So the client can't view the actual code you're running
right
same with php
yeah as long as the file isn't publicly accessible you are fine
hm
well define that i guess
20:09
if it was set up like a file server, like image hosting etc, that would be different
like a public s3 bucket
like firebase's hosting has like a public folder
where index.html and any other pages live
Additionally, nginx and apache have a public folder
If you put your swap.js in it
idk if thats considered "public" or not
running node /var/www/public/swap.js will work
if you can put that file url in your browser and view it, it's public
20:10
But if someone visits jmr.com/public/swap.js, they will see the code
you want it in a file location that isn't served to public requests
So don't put your scripts in the default public folders for your servers
so in theory i could do
swap.js lives in public, but it calls var/www/notpublicdir/secretswap.js
is that what you mean?
yes
20:11
swap.js can live anywhere
But yeah, that's the gist of it
Although, you usually won't use /var/www/
Node projects are executed, not served
i mean it has to live somewhere public to be accessible to a client
So you will usually have a project folder
And then use a process manager like pm2 to serve your node app on a port
you would write the route and link the code
Then connect to ip:port and call your API, which will invoke the function and return the output
20:12
this sounds like beyond the scope of what firebase at least is trying to do
In PHP, this is handled by apache/nginx, which executes the php preprocessor for you
But conceptually, it's the same as having a php script and running the php command manually
Kinda like how you would run sh something.sh to execute a shell script
ok, yea
for example a node.js API route might look like
router.get('/swap/', (req,res)=>{ //my private code here};
i dont know if firebase has like means to do what youre describing
Firebase probably abstracts all this away for you
20:13
JMR you should read into how something like CGI works, which is one of the most basic ways to run a web server
You just provide them then nodejs function, and they will wrap it in an endpoint
But if you want to do it yourself, you will need to do all the steps
yea, thats their functions stuff
like doing it via functions is simple
you'll want to set up a node.js hello world API then you'd understand it a bit better
I would recommend spinning up a small digital ocean or GCP instance and just playing around with it
20:14
ive done that before, long ago
just fucked around with LAMP
It's 2018
wrote php scripts which returned the results of mysql queries stuff like that
Play around with node, golang, python servers a bit
It will help you
20:15
@DaveS im actually super familiar with that
firebase functions use node.js and express
but like he was saying its all abstracted out to a simple index.js file where that code goes
then step 5 is private code and how it's linked up
You're most of the way there, then
so im missing the "how does it integrate" step
yea, thats exactly how my index.js file looks
20:17
that code is private
you can store your secret there
the client only sees what you send back
so i guess what im unclear on is this
if i put a swap.js file in public
and do that exact code you pasted
public seems to be firebase specific here, I'm not familiar with tehir structure
would that be considered safe for the client secret to be in there?
But, I strongly suspect putting it in public will allow the raw file to be served over http
yea you might be right
20:18
what Raghav said
that folder is for images and such
There is probably an app or bin or src folder
@RaghavSood right, meaning even though you cant "see" the code being run, you can just download the entire js file
you run node swap.js
and keep swap.js on a private location
then swap.js listens on a port for requests
and returns responses to those requests
but the thing that runs node swap.js would need to be in that public folder
like we were saying before
20:19
not necessarily no
your listen call is what exposes the server to get requests
well how would a client try to make a request to run it if it was private?
Based on their samples, you want the function code to be in the functions/ dir
listening opens the port for https requests
it just doesn't serve the raw file
ah, ok
@JMRboosties The location doesn't matter. The client will make a request to some API. That request will be internally routed and make your function execute
20:22
i dont think firebase allows for this really
theyd say use a function
Yeah, running node apps is outside the scope of firebase
That's what GCP is for
Because at that point you are serving an application, not just a function
yea
if i had a different architecture doing all that stuff makes sense
but from searching around i dont see like a /private folder or anything
its either public or its a function
Put html, css in public
Put code you want to execute in functions
That's about it
If you want to build an app, grab a GCP instance and play around with it
20:25
i was trying to see if i could put executable code in another file, but thats what gcp or something else would be for
ill be able to do the swap in functions no problem
thanks for the help guys
You can probably put it in another file
node allows for imports
oh yea for sure
i meant like not within functions
@Evan Welcome! Please read, confirm reading, and follow the room rules before you do anything else: room-15.github.io
I have read and understood the rules :)
it was just me looking for a way to host that outside of functions
20:26
Welcome back
thanks
thanks!!
Yeah, probably need GCP then, I'd say the $5 or so for a basic instance would be well worth learning your way around this stuff
Even if just for personal satisfaction
I currently spend more per week on personal learning project costs than on food, can't complain
Gotta learn stuff to keep up these days
welcome back @evan!
o/ Evan
20:34
who dis
Evan was a regular from a while back who works (worked?) at Branch.
ok cool
@DaveS it's sad but this is actually true
you could always threaten motivation to get him to work on it
do it when he seems particularly busy or overwhelmed
and then casually bring your bot back to make him sweat
I don't want him to work on it. It's a bot in javascript written on a pile of crap
more for the purpose of making him work on a pile of crap and less for the purpose of having a bot
20:47
I won't lower myself to his level
21:01
I've lost my motivation for the day. :|
me too lol
got my animation 90% working
perf life coach
teach me pls
where did you find this?
all old and white, surprise surprise
21:13
lmaoo
but seriously I wanna know what made her become a life coach
"I need a job where I just talk about doing something but don't actually do anything"
@TimCastelijns How's your fancy, well-written, not-js bot coming along?
@DaveS you want to be a politician?
No that's Bryn
hence the quotes
21:43
@DaveS Yeah why aren't they following Yeezy
srsly
22:24
@TimCastelijns get that motivation back, you'll be proud of having built it when you do the annual retrospection on January
I'm supposed to give a presentation tomorrow and I'm not at all prepared...
 
1 hour later…
23:48
Thanks for the welcome back, was busy coding at work :) Moved from Branch to Jyve (from silicon valley to the city, helllllloo 5 minute commute to work) in January, I have so much free time now it's making me realize how many hobbies I don't have!
definitely bought a ps4
it's a start
to keep in touch outside of this chatroom feel free to add me here :D linkedin.com/in/evangroth

« first day (2768 days earlier)      last day (2404 days later) »