« first day (4650 days earlier)      last day (520 days later) » 

08:32
it is cheating a bit
all you made is just some http requests :)
I could probably do that with some bash scripts, if my sanity would allow it
@Wietlol 404 Sanity Not Found
501 Sanity Not Implemented
 
1 hour later…
09:47
@ParkingMaster You should really stop claiming you "made a robot that does anything"... You didn't, you implemented a GPT API that can answer your input.
 
2 hours later…
11:54
 
1 hour later…
13:11
@Cerbrus that's not all it does. It can access home smart devices (kitchen appliances, lights, etc.) and give me an accurate weather measurement in my backyard). And on top of that, it can answer all of the questions I trained it to answer. And I am being a little sarcastic... it can't really do "everything" but it does some pretty interesting things.
That's all just API calls, though
I'd describe that as an home automation interface
I know, sorry for the mistake of saying it does "anything" which it clearly doesn't 😂
It's a mix of home automation, and an AI chatbot
Plus it has a physical appearance that I'm still working on
Can your AI desk robot come mow my lawn?
Ah no okay I'm reading more I see probably not dang
@duhaime 😂 no it can't. That would be another thing to consider adding in the future, but I don't think about adding it now lol.
But don't forget, I made all of this with Node.js, which is one of the reasons I love Javascript
 
5 hours later…
18:41
Is there a good practice to get JSON data to the client that is only relevant to client side scripts (e.g. a way to supply the username of the logged in user to scripts running in the client) inside a response or hidden inside the html?
Or should a script just access that data via an API (e.g. a script on every page that fetches("/api/session-data") to get the "interesting" information from the server after the page is already loaded
it depends
if the data is very important, for example, this is the homepage of a high traffic site and this data is used to flow the header... you wouldn't want to load that with fetch.
"flow the header"?
build, render, display, etc
Hmh ... well if the user is logged in his username is displayed on the website anyway, but scripts on the client may want to know the username to make further requests (e.g. a "delete entry" button's fetch call needs the username to know which user's entry to delete) - I am struggling with getting my head around how to get the script to know the username
as the delete calls an API, it should be stateless and thus the api route should supply the necessary data (or data in the request body but this still requires the data to be accessible to the script)
i'd argue in that case it'd be perfectly fine to just send a fetch to get it at some point
whether that be early on during page initialization, or later when you need it
though, what info do you have that allows you to fetch, that the delete call wouldn't have access to?
18:57
fetch the user data?
"Hmh ... well if the user is logged in his username is displayed on the website anyway, but scripts on the client may want to know the username to make further requests (e.g. a "delete entry" button's fetch call needs the username to know which user's entry to delete)"
yeah ... that is the 2nd thing I was re-thinking about my whole website design
like, you really shouldn't need to pass the username back to the server at that point to determine which posts can be deleted
Right now my API calls are authed by either a username + password in the request body or the user's session cookie
as that'd mean anyone can just pass any username to delete stuff
18:59
In principle as the API is only called by fetches from inside a browser window this is not as much an issue as 99% of the calls to the API are authenticated by checking the cookie in the request
DELETE /api/users/bobby-tables shouldn't really do no auth checks before acting.
Correct
OK, if you have authorisation implemented, then what is the issue?
Right now I have a server side middleware that supplies the logged in account to the route handler by either request body username + password or by cookie
If the DELETE /api/users/bobby is done by a user that is not bobby, the request is denied
and DELETE /api/posts/8 is handled differently?
19:02
"request body username + password" that seemss bad. TBH, I can't give a concrete example but there would be a reason why authorisation is an entirely separate part of the HTTP request.
i mean, presumably the post has a owner field, that you can test against the authenticated user
You can probably just do Basic Auth if you just want to supply username/password.
The issue is if I am on the page /website/manage-stuff- where do I supply the information to send api calls from manage-stuff to /api/users/bobby if bobby is the currently logged in user
why is bobby part of the route?
@KevinB Presumably /api/users/<username>
19:05
Uh ... in this case users have "projects" who are identified by the route /foo/username/project (so different users can have projects of the same name), so in order to do something inside the project the client needs to send data to /api/username/projectname/dostuff for example
i've always handled that by having a split there for admin vs end-user. One route for standard endusers who can only edit their own account /api/profile/* and one for admin users /api/users/id/*
but... the alternative isn't a bad solution per se
you just need to request user info at some point before you need it.
@salbeira Is manage-stuff some sort of overview where you can manage other users' stuff? Say, you have a list of comments from different users - you can delete yours but not somebody else's. Perhaps unless you're an admin. If so, then you really just need some link on each post which will delete that comment. And if you're the owner then backend allows you. You just supply the session to the backent to identify you.
if you want to keep that route style, you'd need to request userdata before sending that request
If you mean that manage-stuff is only your own stuff then mostly the same applies. However, you might want to save some information for who the current user is somewhere. You display the username anyway. Just share that information with the page.
And now we come full circle: HOW do I share that information with the page?
fetch it after load is done? have some hidden page elements with id #hidden-user, #hidden-data , read them out in a post-load event and then quickly delete the elements?
Is there a way to send additional JSON data inside a response?
19:10
I dunno. Write it somewhere then read it from there. Stores, modules, global variables, localstorage, etc.
@salbeira In the body, sure. But you only have one body. But where do you want to add data?
If you have some sort of config/setup call for the page, then just make the user information part of it.
Thats what I mean - the response is a html page and inside that response I would like to have the session information "hidden" but "readable to javascripts on the same page" - which I guess is rather scuffed and cursed if I include it inside a script tag or somewhere on the html response
So the solution "do a fetch to /api/session-data" after page load, authenticate the user on that fetch via cookie and then send back a json object "{username: username}" that then gets put in window.MySession or something is the way to go
Well...that's not great yeah. But you can add a <script>window.user = { name: "bobby" }</script> to the page you send back (or any other mechanism to share the user info). I'm not a huge fan of SSR though. That's one of the reasons.
At least it feels to me as you already said rendering that script into the page puts load on having my templates supplied with valid data instead of just sending data back and forth
well, including dynamic content in the base response is a problem in and of itself for some things
now you can't tell the browser to cache it without having to think about it
(or any other caching solution for that matter)
As my website is a university project (not in the sense that it will be graded but as a service I supply to students and staff) that is hosted on our own machines and accessed only by users on our network all the caching and workload optimisation is rather unneccessary for me
I may as well slap a "no-cache" response header in my nginx config in every response
which isn't me saying I do not heed your advice I just say that in my particular instance it is probably irrelevant xD
20:07
Is api authentication via session cookies for browser based api calles a no go? Stuff like OAuth, api keys and such all seem like they are a bad idea as they would need to be stored in localstorage if you want to preserve the auth token or keys across page calls
 
1 hour later…
21:09
apis should be stateless. having to deal with sessions/cookies is super annoying there
and what's wrong with putting an api token in localStorage?
if it's for a webapp (and not someone's script etc that calls the api) then it's perfectly fine to use localStorage like you'd use a session token elsewhere
or you could even have a session cookie and use that to send a request to an endpoint that gives you an api token. not really necessary in most cases though if the API is running on the same server as the rest of the backend...
Why reinvent session cookies via localstorage, though?
Yeah that sounds like "just so you can say I put the apiKey manually into an Authenticate header on my request" - the session cookie is already the token that tells the server who you are (and yes the frontend and api backend is handled by the same application)
The issue only comes when you want a 3rd party app to talk to your API without storing cookies at which point there is always the option to send username and password in the request body
Why in the request body? Why reinvent HTTP authentication via the body of requests?
true ... its just I didnt know there was such a thing when I wrote the first lines of my express app
Also, you cannot authenticate via body for bodyless requests. Like GET
21:17
I ... actually have no idea where to put the data in either the fetch or the express lookup xD
luckily the whole auth thing is inside my auth middleware so I only need to change the code there I think
so my method: POST, body: {username: username, password: password} becomes ... base64(username:password) and put a header in with Authorization: Basic based`
I would be floored if you had to cook up your own code to handle authorisation because nobody at all ever has done this before. I don't actually know how it works in our C# backend but...it just works. You enable something and tweak a couple of parameters in settings to enable it but it works without having to write code for it.
Why are most examples I can find hard-coding the acceptable encoded username password combinations into their app?!
Is this method only for authing fixed, 4 character long username password combinations? I need to fetch username from database, hash pasword, check against password etc. not do some stuff that can be taken care of by an apache regex
21:48
Also I always love that there are "tasks" you want to do like decode the header and there are npm packages expressly for these purposes - then you check the github repositories and the source for the solution is 4 lines long ... These things should NOT have a package but a short and neat "this function does this! copy pase it." page or something
yup
but now you can include that import in 3 different projects rather than copy pasting that function 3 times!
and when they fix a bug (or introduce a vulnerability) in one of those 4 lines all 3 projects can be easily updated!
22:17
true, but 4 lines of code of "putting a string into pieces" should ... in theory ... never require any maintenance
remind me in 5 years when string.split() is the most common vulnerability
btw. is there any reason why the Basic Auth header is base64 encoded or can you just put into your documentation "send this as plain text, it is easier to parse and goes over https anyway!"
Standards
Break the Law! Anyway time to go to sleep

« first day (4650 days earlier)      last day (520 days later) »