News for hackers. Stuff that matters.

A comment on SecureLogin Authentication Protocol 1.0.

Re:SecureLogin Authentication Protocol 1.0 by purvis on Sunday June 04, 2017 @11:28AM (#14482017)
I'm not too familiar with ruby/rails, but does this mean the HTTP request just sits open for up to 20 seconds? Is this common/acceptable practice?

    # user is given 20 seconds to approve the request
    20.times{
      sleep 1
      sltoken = REDIS.get("sl:#{state}")
      break if sltoken
    }
https://github.com/homakov/cobased/blob/master/app/controlle...
[ Parent | on HN ]
Re:SecureLogin Authentication Protocol 1.0 by homakov on Sunday June 04, 2017 @11:30AM (#14482027)
It's not common, but the quickest way I could find to reduce # of roundtrip requests. Happy to hear why unacceptable.
[ Parent | on HN ]
Re:SecureLogin Authentication Protocol 1.0 by purvis on Sunday June 04, 2017 @11:49AM (#14482112)
My initial concern was an aggressive server timeout on nginx/haproxy. I think the defaults should be long enough, but it's entirely possible to have something lower than 20 seconds. (and the app developer might not even be aware of this)

I have no reason to think it's unacceptable, was just curious. Interesting project!

[ Parent | on HN ]
Re:SecureLogin Authentication Protocol 1.0 by zwily on Sunday June 04, 2017 @12:58PM (#14482371)
It just means you're tying up a thread (or whole process, if your rails app isn't running with threads) waiting for the response.
[ Parent | on HN ]
Re:SecureLogin Authentication Protocol 1.0 by homakov on Sunday June 04, 2017 @01:05PM (#14482393)
It's not a requirement though: one may ping from the client side with setInterval.
[ Parent | on HN ]