News for hackers. Stuff that matters.
Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by debarshri on Thursday March 16, 2023 @01:51PM (#35185529)
Hey guys. I am not sure but you might have a security issue or a bug where in anyone can access the database page without login [1]. It give me link to logout and stuff but keeps through errors. UI breaks here too when click on members [2]

[1] https://app.outerbase.com/databases

[2] https://app.outerbase.com/settings

Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by brayden_wilmoth on Thursday March 16, 2023 @02:00PM (#35185692)
Thanks for the call out here on this bug!

We are working on a resolution to this issue right now. This is an issue with our logout function on the frontend not removing the auth token. There is no risk of scope access outside of your machine.

We will push out a fix shortly.

EDIT: Fix has been deployed. Thanks again!

Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by typosaur on Thursday March 16, 2023 @02:49PM (#35186508)
It appears like your fix didn't work

It now just redirects to the auth page. Clicked on the back button in my browser and voilà

https://imgur.com/a/EvMaVu9

Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by brayden_wilmoth on Thursday March 16, 2023 @03:02PM (#35186700)
Hmm I wonder if this is a caching issue. It seems to be working on our part and no data is ever loaded. If you'd be willing to talk through a bit further I'd love to. brayden [at] outerbase [dot] com.
Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by CamJN on Thursday March 16, 2023 @04:47PM (#35188313)
Assuming you use a token similar to JWT , then redirects and removing the token from the client don’t matter if you don’t blacklist the token on the backend, which if they were able to continue by hitting the back button seems the case. This does require you to keep a database of “logged-out” tokens and reject them, and occasionally run a cleanup script on the db to prune tokens from that table after they would have expired, but that’s what is required when you use auth tokens for login.
Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by thejazzman on Thursday March 16, 2023 @05:06PM (#35188625)
Appreciate your taking the time to give us this suggestion -- but to clarify, we do revoke the token :D

From the screenshot that was provided, they're seeing the client render a page, but it's failing to acquire any data from the API. If they opened the network inspector they'd likely see that the requests are 401'ing after logging out.

I'm not pretending that this is good UX -- it's not -- but it's not evidence of a security issue. That said, we have every intention of nailing down fantastic UX as quickly as possible. (I'm a recent addition to the company but) it pains me personally for anyone to see any mistakes and I hope to impress you soon.

Re:Launch HN: Outerbase (YC W23) – A new UI and editor for y... by debarshri on Thursday March 16, 2023 @06:08PM (#35189485)
I will be really honest. I see tools like this complimentary to what we are building (general purpose access and authorization service) so I was really looking forward to play with the tool.

I see some issues with the current version of the product. I think it is 2 cycles behind from being really ready for the the market. First cycle would be feature parity and second cycle could be for robustness because there are alternative that are better. EZSQL is nice but feel very gimmicky.

But there is potential. I know YC's advice is to launch as soon as possible but it is not applicable for all domain and products esp. in enterprise because you have only have few shots to impress people and decision maker are few.

Having said that, there is potential. I am not sure how you can scale the integrations with dbs really fast. You will start seeing problem when you venture out of standard databases and start integrating clickhouse, big query etc. Also, you should consider Grafana as your competitor too as major engineering enterprise do use Grafana as their admin panel.

PS. please take my feedback with grain of salt.

But I think you guys will figure it out.