login-with
Infrastructure
authentication microservice
SHOW HN2017
How HN took it
2 positive, 8 neutral or asking, 0 mixed, 9 critical, out of 19 comments about the project. Thread score -0.20.
Docs: 1 for, 4 againstPrivacy: 0 for, 3 againstIdea: 1 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful idea that removes the need to reimplement login services
From 2 comments
This is really cool. I was looking for something like this a few days ago for a side project. Great job!
johnbellone on HNHow does it handle revoked and expired sessions? From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists…
hultner on HN
GitHub README explains the project well
From 1 comment
I found the GitHub link to contain a lot of useful info about what this is: https://github.com/lipp/login-with Very nice work!
jarym on HN
Objections
Landing page does not explain what the service does or why to use it
From 2 comments
The information on `/login` should probably be on / so I can read somewhere what "Stateless authentication microservice" actually means. Also maybe a sentence why this is neat…
Sujan on HNThis kind of explanation would be really useful on the website. Right now it has nothing to describe what it is/does.
usea on HN
Session revocation and expiry handling is unclear with JWTs
From 2 comments
How does it handle revoked and expired sessions? From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists…
hultner on HNThat's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is…
hultner on HN
Cookie profile data could be tampered with unless the JWT signature is checked
From 2 comments
"On successful login two cookies will be created: ``` jwt - A "JSON Web Token" (JWT) containing profile information and the respective access tokens (Twitter/etc). http-only!…
nielsole on HNThe JWT is signed (see LW_JWT_SECRET env variable), you'll want to check the signature before trusting the rest of the contents.
transitorykris on HN
Social login invites fake accounts and spam
From 2 comments
I cannot wait to allow a bazillion fake Twitter and FB accounts from the Eastern Bloc countries to pour into my website and bigly MAGA. Thanks, social sign-on!
RUTHLESS_RUFUS on HNAdministrators and community moderation who pay attention to their own access logs rather than ambiguous Facebook Review Teams who look the other way.
RUTHLESS_RUFUS on HN
Requests
Add a clear explanation of the service on the front page
From 2 comments
The information on `/login` should probably be on / so I can read somewhere what "Stateless authentication microservice" actually means. Also maybe a sentence why this is neat…
Sujan on HNThis kind of explanation would be really useful on the website. Right now it has nothing to describe what it is/does.
usea on HN
Add LinkedIn support
From 1 comment
Could be useful in my current project, but I need LinkedIn also.
Gys on HN
Publish API documentation
From 1 comment
How does it handle revoked and expired sessions? From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists…
hultner on HN
Questions
What is the use case and what happens after login?
From 1 comment
So what's exactly the use case for this? I'm not entirely sure. Let's say I deploy it. Users of whatever service I provide use this to login to Google, Twitter, etc, then what?…
saganus on HN
How are revoked and expired sessions handled?
From 2 comments
How does it handle revoked and expired sessions? From my prior research this seems to be a problem with the JWT which would either require distribution of ever growing blacklists…
hultner on HNExpired can happen clientside, just check the timestamp. Revoked would be a short blacklist that lasts the duration of the session, once a token is expired it no longer has to be…
nathancahill on HN
Alternatives named
oauth2_proxy
From 1 comment
https://github.com/bitly/oauth2_proxy is a good one as well.
olalonde on HN