Open Side Menu Go to the Top
Register
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** ** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD **

08-02-2017 , 01:42 PM
Suzzer: passport.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 01:47 PM
Passport is to connect off to an oAuth auth service on the side - right? At least that's what I've used it for.

I need a package that handles typical login, password reset, first-time password must-change, email notification, etc. - with customizable page or SPA-widget templates. Maybe password decryption in the DB as well.

I'll look into AWS - there might be something in there.

Actually we used these guys (combined with passport) at the side job. I think I'll just recommend them: https://auth0.com/
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 02:41 PM
Passport has oauth plugins but has just normal local auth as well, thats all I'm using it for.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 02:46 PM
But do you still have to write stuff like forgot password logic, retry lockout, password hint, etc from scratch? In our case users will be added by admin, so they'll have a temp password they'll have to change on first use. Seems nuts in 2017 to write all that logic from scratch.

Like I quote 3 months on this thing and I might have to spend a month on login and user management - for the same features used by millions of apps.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 04:46 PM
Quote:
Originally Posted by jjshabado
Ok, that was confusing.

If you're just talking about recruiters and recruiting companies I'd say you shouldn't spend any time at all dealing with these people when they contact you.
I stopped taking phone calls a long time ago. I have 50,000 lines of code on github. You can download every single thing and use it. If that doesn't prove my mettle, then I don't care about talking anymore. Contracting is nice because the culture is "get **** done" and that's all I care about.

I did try to get into a contracting network yesterday. They sent me a timed test, and to put it nicely, it was one of the most horrendous tests I've ever taken. The editor didn't work very well, and each question would reasonably take an hour to really get right (the test was one hour). These queries were basically impossible to do if you didn't know a whole slew of SQL tricks, like windowing, recursive CTEs, DISTINCT ON, LATERAL JOINS and so forth. I only finished one, so it turns out I'm not a good coder after all.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 06:30 PM
Quote:
Originally Posted by suzzer99
But do you still have to write stuff like forgot password logic, retry lockout, password hint, etc from scratch? In our case users will be added by admin, so they'll have a temp password they'll have to change on first use. Seems nuts in 2017 to write all that logic from scratch.

Like I quote 3 months on this thing and I might have to spend a month on login and user management - for the same features used by millions of apps.
Yeah but you could almost certainly find a foss package that has done it. I did it by hand as a learning tool.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 07:00 PM
I hadn't heard of Auth0 before, seems like a convenient solution but I guess you're giving up a good chunk of control?

I'm interested in solutions here since it's something I know very little about, and seems like cryptography this is an area where it's quite possible to screw yourself over without knowing it very easily trying to implement things yourself? or it the risk not so great?
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 07:43 PM
This is the **** I have to deal with on the day job. I have been BEGGING for node things to work on for over a year. Huge company so I never know what everyone is working on. But presumably my boss could play some kind of role in finding things for me to do which match the reason he hired me. Crazy idea I know.

So anyway one of the few things I do get to do is review someone else's node app every now and then. This app I've already reviewed once, found a bunch of errors, which he fixed. Fast forward a few months, he sent me a link to review again. I found one bug, but otherwise it looked good. He mentioned that he had made some changes. We get on the meeting yesterday and it's totally different code. He expected me to review it over web-connect as he scrolled by. Um no.

*So today he sends me the PR of the new code. This is just a sample:

Code:
    metadataCall: function(app, logger) {
        const unirest=require("unirest");
        //variable to store the obfuscated values
        var i=0, host, metadataObj = {
            metadataSuccess: null,
            obfuscatedYesInMetadata : []
        };
        (function processMetadataCall() {
            switch (process.env.NODE_ENV) {
                case 'production':
                    host="www.X.com";
                    break;
                case 'finalstage':
                    host="finalstage.X.com";
                    break;
                case 'test':
                    host="tst13.stage.X.com";
                    break;
                case 'development':
                    host="tst13.stage.X.com"; //localhost
                    break;
                default:
                    host="tst13.stage.X.com";
            }
            const serviceOptions = {
                host : host, //process.env.NODE_ENV = 'production' ? "http://www.X.com":"http://tst13.stage.X.com",
                path : "/apis/personalization/goldeneye/internal/uuidprofilemetadata/attributemetadata",
                // headers: {},
                method: "GET"
            };
            unirest.get("http://"+serviceOptions.host+serviceOptions.path).end(function(response){
                if (response.status === 200) {
                    if (response.body !== null && response.body !== undefined) {
                        metadataObj.metadataSuccess = true;
                        processSuccessfulResponse(response.body);
                    } else {
                        logger.log('error', "Error receiving data from the Metadata service call");
                        metadataObj.metadataSuccess = false;
                    }
                } else {
                    metadataObj.metadataSuccess = false;
                    logger.log('error', "attributemetadata call failed with "+response.status);
                }
            });
            var processSuccessfulResponse = function(data) {
                // var responseData = JSON.parse(data);
                var responseData = data;
                if (responseData !== null && responseData !== undefined) {
                    for (var key in responseData) {
                        if (responseData.hasOwnProperty(key)) {
                            var value = responseData[key];
                            for (var key1 in value) {
                                if (key1 === 'goldenEyeAttributeMetadata' && typeof value[key1] === "object") {
                                    var value2 = value[key1];
                                    for (var key2 in value2) {
                                        if (key2 === "obfuscatedValue" && value2[key2] === true) {
                                            metadataObj.obfuscatedYesInMetadata[i] = value['goldenEyeAttributeName'];
                                            i++;
                                        }
                                    }
                                }
                            }
                        } else {
                            logger.log('error', "Error with the response received from the Metadata service call");
                        }
                    }
                } else {
                    logger.log('error', "Error parsing the response received from the Metadata service call");
                }
            };
        })();
        return metadataObj;
Holy hell. He doesn't know how to access properties in a JS object w/o looping over them. The switch statement couldn't be more unnecessary. I don't think he has any idea why he's using self-executing functions. But worst of all - his async get method is NEVER GOING TO DO ANYTHING. Arghhh.

Meanwhile I am begging for scraps of node work. This code was so bad I actually mentioned it to his boss, who was on the meeting yesterday. Also because I was ticked about the code bait and switch. His response was basically: yeah we can't find good node people, and only contractors are allowed to develop. Totally FUBAR.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 07:44 PM
Quote:
Originally Posted by _dave_
I hadn't heard of Auth0 before, seems like a convenient solution but I guess you're giving up a good chunk of control?

I'm interested in solutions here since it's something I know very little about, and seems like cryptography this is an area where it's quite possible to screw yourself over without knowing it very easily trying to implement things yourself? or it the risk not so great?
Yeah I would definitely hire a crypto expert if needed. Auth0 can hook up to Amazon directory or whatever it's called. So we might use that for now.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 09:33 PM


This

Code:
var responseData = data;
made me want to throw up. What in god's name? Also lol @ es5 in 2017 unless you're somehow forced to use node under v6. And no linting at all obv. Fun times.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 09:47 PM
If you don't mind hosting a .NET app I recommend Identity Server. I set up v3.0 at last job and it was a pain, but I have heard from a couple of people that this latest version is the bees knees.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 10:23 PM
Use auth0 and make them use FB or Google for their ID and stay out of the username business.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 10:49 PM
Quote:
Originally Posted by kerowo
Use auth0 and make them use FB or Google for their ID and stay out of the username business.
You would instantly lose me. I use oauth/"sign in with xxx" for literally nothing, as I don't want those permissions shared, and I use a password manager for easy local auth.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:23 PM
auth0 has options to hook up with stuff like Windows AD, AWS and also create an account directly with auth0 and just use that login. https://auth0.com/docs/identityproviders

However in the new project's case we want admins to create the accounts first. So having them create the account in AWS then user can login with auth0 makes sense.

Regarding FB losing you - yeah one of the first moments I realized the side job guys didn't really know what they were doing is when they insisted that our (generally) wealthy older users, uploading the most important documents in their lives, were going to be cool with using their FB, G+, LinkedIn or WindowsLive account as their only login options. Like it was spotify or some ****.

I basically refused to not allow straight auth0 account as a login option. I was like - we're going to put this in front of investors insisting grandpa warbucks is gonna use his FB account and they'll laugh us out of the room.

The boss is also obsessed that users are going to be logged on via the web and mobile at the same time and wants all kinds of weird requirements around that. And they just decided they were going to do all kinds of work to preserve form state on the back end - in case of an accidental disconnect in the middle of filling out a form. Keep in mind they still haven't built the actual product yet in it's latest incarnation. The site is all bells and whistles and no actual product. It's the exact opposite of an MVP.

Last edited by suzzer99; 08-02-2017 at 11:33 PM.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:31 PM
Quote:
Originally Posted by ChrisV
If you don't mind hosting a .NET app
Well if they were willing to pay me to learn .net from scratch and I didn't have a day job, that could be an option.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:42 PM
auth0 has some problems/bugs. I broke my collarbone so I'm down to one hand but I can expand on this later. Biggest problem i've seen is that their user lookup api and maybe even logging in is handled via elastic search as sort of a lazy search engine/cache.

result? make an acct and can't log in until elastic search updates. sometimes deleted accts get "stuck" in elastic cache. show up in search but can't view their profile.

their means of providing multiple sources of users is... ****ed. their data model is weird.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:45 PM
Honestly, if anything remotely like that is how you have to write a node app in 2017 that **** should be scrapped and everyone should just use rails, Django, flask, Sinatra, etc depending on how many batteries you need.

Also how are there no definitive auth options for Node yet? There are a handful that are practically foolproof in rubyland.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:50 PM
Quote:
Originally Posted by suzzer99
Well if they were willing to pay me to learn .net from scratch and I didn't have a day job, that could be an option.
In theory it works out of the box and you can just make API calls to it, but I'm not sure how closely theory approximates practice in v4.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-02-2017 , 11:58 PM
Quote:
Originally Posted by RustyBrooks
I broke my collarbone so I'm down to one hand but I can expand on this later.
Sure, that's why.

Last edited by Grue; 08-02-2017 at 11:58 PM. Reason: sorry
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 12:06 AM
Quote:
Originally Posted by Grue
Sure, that's why.
this extended break from sexting has just been the worst
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 12:21 AM
Quote:
Originally Posted by blackize5
Honestly, if anything remotely like that is how you have to write a node app in 2017 that **** should be scrapped and everyone should just use rails, Django, flask, Sinatra, etc depending on how many batteries you need.

Also how are there no definitive auth options for Node yet? There are a handful that are practically foolproof in rubyland.
There is - passport. I just want all the other stuff - login, login retry blocker, password reset, etc. I want a bolt-on package that does all that for me. In 2017 I feel like none of that stuff, including the actual web UI should have to be written from scratch.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 12:22 AM
Ah. Maybe I'm just taking for granted that Ruby has an option that has all of that and is essentially endlessly configurable.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 12:25 AM
Define option. Can you link to something?
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 01:39 AM
Sure. There's a gem for Rails https://github.com/plataformatec/devise that pretty much has all the bells and whistles with mostly sane defaults. And pretty easy to customize where you need to.

It's built on top of warden https://github.com/hassox/warden which is basically a middleware layer that handles authentication and is compatible with any Ruby Rack framework. Just off the top of my head Devise adds in a bunch of routes, html views, mail templates and events to send them, password hashing, session expiration, and lockout after failed attempts.

There are a couple of lighter weight libraries that I know a lot less about too. I'm just kind of surprised Node doesn't have something this full featured.
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote
08-03-2017 , 01:45 AM
Well warden sounds a lot like passport. There could be devise out there I just haven't found it (or looked that hard yet TBH).
** UnhandledExceptionEventHandler :: OFFICIAL LC / CHATTER THREAD ** Quote

      
m