Syntax - Tasty Web Development Treats4 Mar 2019

Hasty Treat - Authentication: LocalStorage vs Cookies vs Sessions vs Tokens

In this Hasty Treat, Scott and Wes talk about authentication — the difference between localStorage, cookies, session, tokens and more! LogRocket - Sponsor LogRocket lets you replay what users do on your site, helping you reproduce bugs and fix issues faster. It’s an exception tracker, a session replayer and a performance monitor. Get 14 days free at https://logrocket.com/syntax. Show Notes 4:20 - How should we track users? Token based - generally stored in the client Session based - stored on the server Token Based (JWT) 6:00 - Token-based auth Stateless - the server does not maintain a list of logged in users Scalable - you can use serverless functions easily Cross domain Data can be stored in JWT Easy to use on non-web sites like mobile apps Hard to expire tokens — you must maintain a list of blacklisted tokens 7:48 - Session-based auth Stateful - generally you maintain a list of session IDs Passive - once signed in, no need to send token again Easy to destroy sessions 10:48 - How do we identify the user on each request? localStorage or Cookies? A common misconception is that localStorage is for tokens while cookies is for sessions With localStorage, we need to grab the token and send them along on each request With cookies, the data is sent along on each request 11:25 - Security Issues XSS for Tokens - make sure bad actors can’t run code on your site Sanitize inputs XSRF - CSRF tokens are needed Links Cookies vs Tokens: The Definitive Guide Tweet us your tasty treats! Scott’s Instagram LevelUpTutorials Instagram Wes’ Instagram Wes’ Twitter Wes’ Facebook Scott’s Twitter Make sure to include @SyntaxFM in your tweets

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(1023)

1023: Mosh, Caddy & Tailscale: A Remote Dev Deep Dive

Running your dev process off your main machine doesn’t have to mean the cloud. Scott and Wes break down how to host projects on a box you can reach from any device, close your laptop mid-build, and ke...

22 Jul 0s

1022: Bun re-written in Rust, Zig team big mad

CJ and Scott break down the biggest week in web dev: TypeScript 7 ships with a 10x-faster native port, Bun gets rewritten in Rust (much to the Zig team’s dismay), and Better Auth joins Vercel. Plus GP...

20 Jul 1h 15min

1021: We got addicted to an AI model we can't talk about

Dax Raad, co-founder of OpenCode, joins Scott and Wes to talk remote dev servers, OpenCode 2.0, and why his team is “addicted” to AI models they’re not even allowed to name yet. Show Notes 00:00 In...

15 Jul 51min

1020: Do You Read The Code?

Auto-accept on, brain off? We’re getting into whether anyone actually reads the code they ship anymore — then it’s HTTP’s first new method in 16 years (meet QUERY) and OpenAI’s compute-hungry “Sol Ult...

13 Jul 1h 27min

1019: LGTM, Ship It: The AI Code Review Problem

This episode tackles the growing pains of AI-assisted development, from the struggle of reviewing thousands of lines of agent-generated code to the mounting technical debt when teams merge PRs without...

8 Jul 39min

1018: Google fires Workspace CLI Creator

Google fires the engineer behind its Workspace CLI tool, OpenAI previews GPT-5.6 with three new model tiers, and Astro 7 lands with a full Rust rewrite. Plus: Coinbase cuts token costs with smarter ro...

6 Jul 1h 17min

1017, We need to stop calling it “AI”

Scott and Wes raid the listener mailbag to settle the pnpm vs. npm debate, decode how web standards sneak into your browser, and ask the big one: is “AI” even intelligent, or just fancy autocomplete? ...

1 Jul 56min

1016: More Bots Than Humans

Wes, Scott, and CJ break down the latest web dev news. From AI agents and coding tools to Deno Desktop, Nub, and predictive UX. They also discuss bot-filled social media, remote work debates, and a sl...

29 Jun 1h 23min