« first day (3342 days earlier)      last day (1599 days later) » 

5:00 PM
thanks, appreciate it
 
Wait, JBI
 
Esp since yuo are 16 😛
 
(fun fact, I had my first code job at 16 too heh)
 
Is this entirely originally made by you?
 
5:01 PM
> This module is based off of csurf and uses an almost identical API, however it uses an existing login token instead of creating a new token and cookie.
 
Oh.
@ShrekOverflow So what do you recommend buddy
 
@HassanAlthaf I can assure you from my ~4 years of experience with OAuth 2.0 and OpenID Connect that

server.hassan.com (forwards request after adding the client credentials) -> api.com
api.com (returns token for user with valid username, password)


Is not the right use of OAuth 2.0 in most scenarios, this is _kinda_ valid for Resource Owner Password Grant.

(I am assuming you are sending the credentials from hassan.com to api.com)
 
I just rewrote the API to use a login token instead of a new token.
 
In a classical OAuth 2.0 flow you'd redirect the user to api.com and they'd enter their credetnaisl there
 
5:03 PM
Lets just say, the api.com and hassan.com also fall under the same domain name
 
API.com would end up with a session for the user and issue you a token
@HassanAlthaf doesn't matter
 
accounts.google.com and mail.google.com fall under the same domain
 
It has one main security issue which is the fact that the login form isn't CSRF protected. But that isn't a huge deal.
 
Ok, lets say I got the token.
 
5:03 PM
but mail.google.com doesn't accept your credentials, it redirects you to accounts.google.com which then accepts your credentials
 
Where do I store that token?
 
@HassanAlthaf for most use-cases if you have a session on the authorization server anyway
rely on that session 😛
you can always ask it for a new one
 
with the refresh token?
 
No
with the session it has
and perhaps with a refresh token if your server supports refresh token rotation
 
ok, it has a session now.
it does
but my frontend needs to identify the user with the server eh?
 
5:05 PM
No
your frontend just points to the server
for all token issuance and treats the access tokens opaquely
A good guide would be
 
ohh
I get it
now!
correct me if im wrong.
So a user needs to get authenticated, my frontend redirects to some minimal login page on the ROs server
 
the ROs server validates the credentials
and returns an access_token and refresh_token to me
 
shrek, do they do summer internships by any chance?
 
Also if the ROs server has a session, it should instantly redirect back with the response
@JBis I can ask
 
5:07 PM
Yes, it does have sessions.
(I wonder if I am working too hard as an intern too!)
So pls go easy on me :D
 
How would I structure a state selector so that it dispatches an action if there is no data in state?
 
@ShrekOverflow So, on the frontend
When I request, lets say my profile picture
How'd the ROs server know which user is requesting this?
The access_token needs to be there right?
the ROs server requires the access_tokenn
 
@Vap0r have you considered jquery?
 
Without the access token, you are considered unauthorized
 
Yes
That is how Oauth 2.0 works
 
5:10 PM
Ok.
Where do I store the access token?
 
its not an authentication protocol, its an authorization protocol
 
Don't let shrek lie to you; oauth is stinky
and JWT is a sin
 
On my react app, I need to store that access token
for a "remember me" feature
 
@ndugger and yet ya'll use it
 
:(
 
5:11 PM
@ShrekOverflow If you can that would be great. Remote would be best if possible although I may (big may) be able to get out there. thanks!
 
@ndugger I am happy to connect you to some serious security folks
if you fancy visiting Seattle 😃
 
I can't stand JWT. It's unnecessarily esoteric
 
How do I store that access token safely?
 
@ndugger yes
That i agree with
@HassanAlthaf on the client frontend, I never store em :P
 
I don't mind OAuth, really
just JWT
 
5:11 PM
I just keep them in memory and forget about it
the authentication / authorization server
 
so everytime, the user has to login/
 
should implement the remember me feature
you simply point to it
 
@HassanAlthaf no.
😃
@ndugger Hopefully nobody told yu about this tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-02
 
wait
how do I know in my forntend app
 
5:12 PM
@ndugger jQuery was my first choice
 
lets say today i logged in
 
I don't recall. I know we have a SAML implementation
 
and my second
 
@ndugger SAML is way way worse than OAuth lol
 
and in 3 hours, i goto my app again, how does the app remember my tokens?
 
5:13 PM
like really really esoteric
 
We have both, I dunno how it all works together
 
I just send the tokens to the ROs server right to identify myself?
 
@HassanAlthaf it just asks the Authorization / Authentication server
 
We use JWTs
... incorrectly
 
I think SAML handles our single-sign on, or something like that
 
5:13 PM
@ShrekOverflow how :O
 
@HassanAlthaf you need not worry about that :)
 
@ShrekOverflow I watched a crash-course on this subject, and he stored the god damn access_token
 
that is the authentication / authorization servers job
 
in a cookie
and u need that in every request :////
 
@ndugger but do you have any idea how to dispatch an action from a state selector?
 
5:14 PM
@HassanAlthaf cookie, memory, localStorage are all storage solutions
 
bbubt apparently
 
Because I have this store that I want everyone to use in our app, and we had the discussion of the module being used to auto-dispatch an action, but that was viewed as a little to aggressive in the sense that a developer may forget to clean out their module imports when not using the store and would have unnecessary data calls
 
storing in cookie
 
In your case if your authorization server supports sessions
you don't need to persist anything
 
will make my app vulnerable to
 
5:15 PM
at worst your initial request will be ~1 second long
 
So it was requested for me to see whether we could make it so the state selector checks for existence of state and if it doesn't have it dispatch an action that gets the data we need
 
@HassanAlthaf ignore that if you are doing oauth correctly the spec authors already considered those
 
I'm so confused lol
I think I should get some sleep, it's 1:16am.
 
Step 1. Implement the right oAuth flow
because atm you are doing something really freaky / exotic
 
5:16 PM
@ShrekOverflow woah slow down not so fast
 
You're rightly.
 
@Vap0r he is literally taking the user's credetnials in his app and forwarding it to the 1st party
that is def. not the right flow
I need to work -- shoot.
 
how can I test a value if its a number? I know I can detect strings, and separate numbers with regex.

but then comes the decimal.... I know that Javascript has natural support for decimals in numbers, but how can I search a value for numbers OR numbers with decimals, and separate those from default strings in quotes
Like... I wish JS had a default function for detecting if the value was a string or integer (Legit, strings have quotes on them, integers dont...)
 
@Vap0r redux makes me want to die. I really hope hooks kill redux entirely.
so no
 
@ndugger amen
 
5:20 PM
hooks?
 
I haven't touched Redux since Hooks
@Vap0r Facebook bought the Redux guy
he brought a better version of redux right into core
 
@ShrekOverflow God darn, now I understand!
 
and also more sanity to react in general
@HassanAlthaf <3
 
Thanks man.
but I have a question
 
5:21 PM
I'm using angular
 
The RO would call back
 
How do I hooks?
 
oh gross
poor vap0r
 
After the user authorizes right?
 
no hooks 4 u
nerd
 
5:22 PM
@HassanAlthaf Yep
 
Im an idiot
isNaN() exists..
 
Well, the spec also requires android/ios apps
 
@TaylorS Don't be so hard on yourself
 
Im a fliptard once again
 
How would the RO call back the android/ios apps
 
5:23 PM
@HassanAlthaf Android / iOS Apps have KeyChain and it's Android Ripoff
 
@TaylorS I recommend that you use the namespaced version of that function Number.isNaN()
 
@ndugger aNgULaR iS NoT So BAd :/
 
well, I mean in one of my older projects I made like a 2 mile long if statement detecting for different chars with Regex
 
you store the refresh token there
then ask for AT
 
when I couldve just done if and else with an isNaN() statement
 
5:23 PM
Browsers are a whole different beast
 
FeelsBadM8
 
@ndugger why?
 
@ShrekOverflow So, would they collect the username, password manually?
 
@HassanAlthaf Nope iOS and Andorid both have explicit apis for this
 
Why use the namespaced version of functions? So that it's clearer to the developers reading your code. What do you think the point of namespaces is?
 
5:24 PM
The iOS and Android would use React Native
How would I go about using this?
 
isNaN is pretty clear
 
@HassanAlthaf This ist he iOS version of doing that developer.apple.com/documentation/authenticationservices/…
 
@Vap0r the point is that it isn't always, so it's good to stick with a convention of properly namespaced functions
 
or you can just use Google's AppAuth and point it to your server
which will handle all the nit-bits for you
(such as calling this)
@HassanAlthaf We recommend this even for first party apps and have customers who do this vOv
 
It's a React Native app
Not a native app
 
5:26 PM
React Native is still native
Like i said, AppAuth
I need to work, cya!
FWIW You can ping me tomorrow
 
@ndugger after looking at it I'm really not sure that hooks actually replace redux at all
 
They definitely do
It requires a shift in thinking, but they definitely do replace all third-party state management
 
@Vap0r They definitely do
It requires a shift in thinking
but they definitely can
WAIT @ndugger wtf
 
I don't see how.
 
stop copying me
weirdo
 
5:28 PM
SHIFT THINKING!
 
It seems the setState is pretty analogous to a dispatcher
 
Bruh, you don't use classes with hooks
you go purely stateless/functional
 
@ShrekOverflow Can't use that. Need to expose client secret.
 
@HassanAlthaf You don't
 
I see that, but redux doesn't necessitate a class
Redux is a state management pattern
 
5:29 PM
@HassanAlthaf Remember step 1, use the proper grant
 
Then?
 
Hooks are as well
shift your thinking
 
Authorization Code grant is valid for frontend clients w/ special provisions ofcourse
 
or else
 
// base config
const config = {
  issuer: '<YOUR_ISSUER_URL>',
  clientId: '<YOUR_CLIENT_ID>',
  redirectUrl: '<YOUR_REDIRECT_URL>',
  scopes: ['<YOUR_SCOPES_ARRAY>'],
};
 
5:29 PM
> You go purely stateless/functionall
 
So here, I'd just do issuer, redirectUrl
 
But it appears you really don't
 
The issuer would e my middle man
 
bruh
 
5:30 PM
Middleman fills it up and forwards it?
 
Just make sure the server has all the grants enabled
@HassanAlthaf No
 
I wouldn't expect an angular developer to understand
That was a really good burn
 
Point to the OAuth server if you get an error, share it iwth me
 
How do I include my client_key?
 
then talk to the RO
@HassanAlthaf by proper oauth you shouldn't need to
 
5:31 PM
I'm the RO lol
 
oof
 
I'm just not allowed to modify the code
 
So for all this time you were talking about yurself ._.
 
 
@HassanAlthaf Then you are not
 
5:31 PM
> miro.medium.com/max/1604/1*K5QpNirqwE9DUCnFMSe-zQ.png
WACK
 
If you are the RO you can also enable the proper grant type
 
i can do that
just cant modify features
 
If you want to try this out in action
 
5:32 PM
 
just signup for a free auth0 account
 
like add new modules, change business rules for data
 
and setup our native and web quickstart
 
Dope
 
I need to go bye
or I ain't getting work done
 
5:32 PM
@ndugger if you click this image you'll see the hook "flow"
 
I can't read
 
@ShrekOverflow gl buddy
 
It's an image
 
thanks for the help.
i'll catch ya tomorrow to continue <3
 
With symbols
 
5:33 PM
But also, I've used redux, and I've used hooks. I can say for certain that hooks can replace redux entirely.
 
Btw is Redux good?
 
Yeah sure
 
no
 
I need state management in my react app
 
hooks
 
5:33 PM
what's that
 
@HassanAlthaf use hooks
 
It's a new layer of state management built into react
 
@ndugger I'm not even trying to disagree. What I'm trying to look at is the overarching state management pattern that I could possibly retool to work in our angular app, but I'm not seeing anything that goes against the redux design
 
closes this chat
 
Oh.
So I don't have to connfigure Redux???? :DDDDD
It's just one liners of Set/Updates?
No need of reducers and actions???
and dispatches
 
5:36 PM
@ndugger it seems to me the only thing hooks definitely enable is class components, which isn't a benefit available in angular
 
Pls say yes, I'll e so happy.
 
With hooks you don't use class components
so wat
confusion
 
What I'm saying is that redux is a state management pattern, it seems hooks are a state management tool made for react
They don't really seem to be interchangeable
 
Oh yes, it is. I only mentioned hooks to you before you said angular
Angular also makes me want to die, but for different reasons
 
Im using class components
Likewise, if your component:
Doesn’t use the network.
Doesn’t save or load state.
Doesn’t share state with other non-child components.
Does need some ephemeral local component state.
You may have a good use case for React’s built-in component state model. React hooks will serve you well in those cases. For example, the following form uses the local component state useState hook from React.
 
5:39 PM
I mean I agree with a lot of what you're saying for angular
But React is no better in many ways.
When native is fully there I think it'll be the way to go
 
Most of the stuff my component already does, so does that mean Redux is a better choice?
 
But currently I don't see templating being as good as it is in either React or Angular
 
@HassanAlthaf you can use hooks with network requests, loading of state from local storage, etc. That list isn't really accurate, imo
 
Redux is never a better choice over hooks, from my experience
 
5:40 PM
And component state "diff-ing" probably won't ever be a truly native implementation, but rather an abstraction.
@ndugger basically it seems that there isn't a new-and-improved state management pattern that bests redux, just better tooling?
 
You do realize anyone can write an article on medium, and write anything they want? That's his opinion. You have two people in here telling you that it does replace redux. It's up to you as an engineer to decide what's best for your project.
 
I'm not an engineer
Just an intern :(
 
@Vap0r redux isn't a pattern, it's an implementation of a pattern, which hooks also follow
 
@HassanAlthaf you are also sleep deprived
 
Hell yea I am
Sleepinng only 3 hours a day
 
5:42 PM
@HassanAlthaf I used the term engineer very loosely. You're an engineering intern; nobody is preventing you from thinking about what's best for your project
Be an engineer, creatively
Design your systems
 
@ndugger I'd love to learn from Room 17 sir.
 
be an intern legally
don't get sued
roll credits
 
@ShrekOverflow I am legally.
I work 9am-6pm
 
That ws a joke lol
I am assuming India?
 
6pm-3am is research
Malaysia
 
5:43 PM
Ok SE Asia
 
its an MNC
 
Are you in probation or something?
 
Fortune 500 :D
no, its a part of my degree. at the end of 2nd year, you need a 16 week internship to proceed to third year.
 
so at the end of this, if they want me, they could offer to hire me after i graduate
or, we separate ways.
 
5:45 PM
If the client credentials approach is what was suggested to you by higher ups
you should send them to the nearest OAuth expert
 
im working under the director
and he said u can do whatever u want
 
Watch this 😀 it'll help
 
heard of HP Enterprise Services?
 
i work there
 
5:47 PM
Nice!
 
heard of CSC?
CSC bought HPE and they have merged together
And formed DXC Technology
DXC Technology is an American multinational corporation that provides B2B IT services. == History == === Creation === DXC Technology was founded in 2017 as the result of the spin-off of Hewlett Packard Enterprise's Enterprise Service segment and its merger with Computer Sciences Corporation (CSC). At the time of its creation, DXC Technology had revenues of $25 billion, employed 170,000 people and operated in 70 countries.The spinoff from HPE did not include two parts of the Enterprise Service segment: the Mphasis Limited reporting unit and the Communications and Media Solutions product ...
 
@ndugger after some digging I have determined that you're wrong, redux is a pattern
 
So don't worry, my manager has asked me to go easy on coding multiple times and focus on sleep
But lets say I'm a nerd and I can't sleep due to curiosity :D
 
vOv
I do OAuth for a living 😛 (lets better define)
 
haha lol
The level of coincidence
Stuck with OAuth -> Meets an OAuth expert
 
5:51 PM
vOv I wouldn't call myself an expert, that would be someone like Vittorio
or Jared
 
If you compare your OAuth skills to mine
You're definitely an expert :D
 
"watch the video"
 
Yup.
I've bookmarked it.
That goes to my watchlist during coffee break at work
I need crap tonnes of coffee to watch theoretical videos.
And a few smokes :D
Bbtw, I want to improve my coding skills.
Any resources you recommend?
I saw GraphQL recently, is it worth picking up
 

« first day (3342 days earlier)      last day (1599 days later) »