Hydra
Security and privacy
oauth2 authorization server
SHOW HN2016
How HN took it
5 positive, 16 neutral or asking, 0 mixed, 5 critical, out of 26 comments about the project. Thread score -0.16.
Execution: 1 for, 1 againstIdea: 1 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Easy to run: boot the Docker image and you are done
From 1 comment
Thanks, however Doorkeeper is an SDK, right? With Hydra, you simply boot the docker image and are done. If you're interested in OAuth2 frameworks, check out…
arekkas on HN
Well engineered and built on the security-focused fosite library
From 2 comments
Ok, thanks. So let's say I wanted to use Hydra for authenticating requests made to my REST API, I'd have to make an API call to Hydra on each request, right? Would be interesting…
olalonde on HNOAuth is a framework not a protocol. The security it provides can vary greatly between implementations. Fosite (which is what this is based on) is a very good implementation from…
abritishguy on HN
Objections
Claims OpenID Connect but tokens are opaque, not JWT
From 2 comments
You're doing OIDC but OIDC requires JWT. Well sorry but if you're not using JWT then this isn't OIDC. The whole point of OIDC is token verification, you provide an identity and…
dalu on HNI know it's in the title but I don't see any OpenID capabilities here. Looks like Oauth2 spec implementation. Am i missing something?
sakopov on HN
Revoking JWTs before expiry is hard, a trade-off with per-request checks
From 2 comments
One thing I've not quite got my head around with JWT is not authenticating tokens with the server on each request - am I really just meant to assume a token is trusted until it's…
jon-wood on HNTechnically JWTs cannot be revoked once they're issued (they just expire). You have to make sure that you delete the JWT from your preferred storage when you sign a user out and…
sakopov on HN
Requests
Integration examples with web frameworks like Express, Rails and Django
From 1 comment
Ok, thanks. So let's say I wanted to use Hydra for authenticating requests made to my REST API, I'd have to make an API call to Hydra on each request, right? Would be interesting…
olalonde on HN
A serverless AWS Lambda version
From 1 comment
It'd be really neat to see an amazon lambda serverless version of this.
smw on HN
Support for issuing JWTs
From 1 comment
Depends, if you use JWT you can cryptographically verify that the token and the token claims are valid. Right now, Hydra does not issue JWTs but it would be easy as pie to add…
arekkas on HN
Questions
How to integrate with an existing API, and whether it proxies requests
From 2 comments
How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there…
olalonde on HNDoesn't the nature of an OAuth server imply that it can be added to existing infrastructures? Or is there an issue you foresee with non-Hydra libraries?
simplify on HN
Whether it replaces hosted services like Auth0
From 1 comment
Would this or coreos/dex replace something like Auth0?
ClayM on HN
Alternatives named
Doorkeeper
From 1 comment
If you're interested in this sort of thing, Doorkeeper[1] is a robust, open source OAuth 2 provider that's been around for about 5 years. We use it as a standalone app, and have…
simplify on HN
Dex (coreos)
From 1 comment
Also similar: https://github.com/coreos/dex
ethernetdan on HN
Auth0
From 1 comment
Would this or coreos/dex replace something like Auth0?
ClayM on HN
Kong
From 1 comment
How do you integrate this with your existing API? Do you need to proxy requests through Hydra or do you just need to read and trust Hydra-signed tokens on every request? Is there…
olalonde on HN
Let's Auth
From 1 comment
Check out Let's Auth: https://github.com/letsauth/letsauth.github.io It's a successor to Mozilla Persona in development. Details in the readme and on freenode #letsauth (mirrored…
scrollaway on HN