News for hackers. Stuff that matters.

A comment on Show HN: Clerk – all of user management as-a-service, not just authentication. Parent comment

Re:Show HN: Clerk – all of user management as-a-service, not... by colinclerk on Monday February 08, 2021 @04:06PM (#26070127)
Hi dubcanada,

Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next few weeks - but let me try to hit some of the most important points:

* Session management is handled with secure, httpOnly cookies. We have you set a CNAME in production so we can set cookies in a first-party context (SameSite=Lax). * Cookies are scoped only to domains that require authentication data. If your backend is on api.example.com and you're running hosted Wordpress blog on blog.example.com, Wordpress won't receive your session cookies. * Passwords are bcrypted * All frontend-facing endpoints have CSRF protection enabled

Please let us know if there is anything specific we can help clarify. We've gotten into the nitty gritty so there's a lot to document, and it would be great to understand what areas to surface most prominently.

[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by bpicolo on Monday February 08, 2021 @05:32PM (#26071177)
Glad you chose cookies for this versus localstorage JWT tokens. Kudos for that.
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by braveyellowtoad on Monday February 08, 2021 @06:30PM (#26071824)
Out of curiosity, why are cookies preferred to local storage ?
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by bpicolo on Monday February 08, 2021 @07:22PM (#26072263)
As the others said - XSS. Stored XSS can still be a vulnerability with secure cookies, but locally stored tokens are a dramatically easier thing to take advantage of as an attacker, as they can just exfiltrate the token and hit your APIs with it.

For web browsers, cookie-based auth solves a ton of browser-specific problems that history has spent a long time building up answers for.

[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by maldini94 on Monday February 08, 2021 @07:09PM (#26072146)
XSS attacks.

Also note that the cookies should be http only and with the secure flag

[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by andrewnicolalde on Monday February 08, 2021 @06:50PM (#26071998)
Any JavaScript on the same origin can read localstorage IIRC.
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by robertlagrant on Tuesday February 09, 2021 @06:28AM (#26076238)
Your HIPAA status will be important for the increasing number of health related apps out there that would probably use a service like this.
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by itisit on Monday February 08, 2021 @04:08PM (#26070148)
SOC 2?
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by colinclerk on Monday February 08, 2021 @05:01PM (#26070804)
Not yet. We plan to pursue SOC 2 as we build out Organizations, since it's a clear requirement in a B2B context.
[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by itisit on Monday February 08, 2021 @06:13PM (#26071647)
And B2C. You really ought to provide more transparency around your current security practices on your site. I do not see why someone should implicitly trust your service without any assurances, guarantees, descriptions, whitepapers, etc.

Here's a good reference: https://trust.okta.com

[ Parent | on HN ]
Re:Show HN: Clerk – all of user management as-a-service, not... by e-clinton on Monday February 08, 2021 @11:49PM (#26074006)
Bcrypt should be replaced by Argon2
[ Parent | on HN ]