Ask HN: What do you use for authentication and authorization?

Re:Ask HN: What do you use for authentication and authorizat... by atonse on Thursday December 27, 2018 @05:50AM (#18768787)

I thought the concern was security.

Anyway HTTP2 would hopefully address that (through header compression), and things like zero-RTT TLS and keep-alive further minimize the overhead of an additional request.

Plus doesn't CORS only make preflight requests periodically, not for every request?

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by Ayesh on Friday December 28, 2018 @01:05AM (#18775124)

I wrote/research a lot about http/2, and even has a small tool for it (https://http2.pro).

Among many things you get from http/2, it cannot eliminate round trip time. Sure, you can keep a connection alive but that's possible with http 1.1 too.

Header compression is HPACK. If the header changes even the slightest bit, it's not cached. Dynamic URLs and headers can easily bust HPACK compression.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by luhn on Thursday December 27, 2018 @11:23AM (#18770402)

Preflights are cached, but because CORS is per-URL caching can be of limited value. If your API uses `/info` and `/edit`, a preflight request has to be made for both (assuming a preflight is necessary). If your application has dynamic URLs (e.g. `/widget/1`, `/widget/2`, etc.) the problem is exacerbated even further.

[ Parent | on HN ]