Syntax - Tasty Web Development Treats4 Mars 2019

Hasty Treat - Authentication: LocalStorage vs Cookies vs Sessions vs Tokens

In this Hasty Treat, Scott and Wes talk about authentication — the difference between localStorage, cookies, session, tokens and more! LogRocket - Sponsor LogRocket lets you replay what users do on your site, helping you reproduce bugs and fix issues faster. It’s an exception tracker, a session replayer and a performance monitor. Get 14 days free at https://logrocket.com/syntax. Show Notes 4:20 - How should we track users? Token based - generally stored in the client Session based - stored on the server Token Based (JWT) 6:00 - Token-based auth Stateless - the server does not maintain a list of logged in users Scalable - you can use serverless functions easily Cross domain Data can be stored in JWT Easy to use on non-web sites like mobile apps Hard to expire tokens — you must maintain a list of blacklisted tokens 7:48 - Session-based auth Stateful - generally you maintain a list of session IDs Passive - once signed in, no need to send token again Easy to destroy sessions 10:48 - How do we identify the user on each request? localStorage or Cookies? A common misconception is that localStorage is for tokens while cookies is for sessions With localStorage, we need to grab the token and send them along on each request With cookies, the data is sent along on each request 11:25 - Security Issues XSS for Tokens - make sure bad actors can’t run code on your site Sanitize inputs XSRF - CSRF tokens are needed Links Cookies vs Tokens: The Definitive Guide Tweet us your tasty treats! Scott’s Instagram LevelUpTutorials Instagram Wes’ Instagram Wes’ Twitter Wes’ Facebook Scott’s Twitter Make sure to include @SyntaxFM in your tweets

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(1047)

1047: Adobe has a big problem

Someone just clean-room ported seven Adobe apps to Rust, and Wes is shocked at how good it is. Scott and Wes break down what it gets right, what’s still missing, and why copying software is easy but i...

14 Okt 35min

1046: The Pi Updates are insane

Scott, Wes, and CJ break down the latest Pi updates, including durable long-running agents, Codemode, and MCP support, then debate whether pull requests are dead in favor of issues. Plus Supabase pick...

12 Okt 1h 40min

1045: Who can actually max out 5 AI subscriptions?

Scott and Wes answer listener questions about what replaced blogging, what to do while your AI agent works, and who should pay for token costs. They also cover keeping agents from going off the rails,...

7 Okt 52min

1044: Ruby on Rails is Dead

Scott, Wes, and CJ ask whether Ruby on Rails is really dead (and whether Rust is just Rails you don't have to read), then dig into Meta's new Muse agent, which is free, comes with its own VM, and is a...

5 Okt 1h 20min

1043: I’m Using GPUI For Everything

Scott and Wes ditch Electron and Tauri for GPUI, the GPU accelerated Rust UI framework from the Zed team. They get into its React-like API, styling that feels a lot like Tailwind, GPUI Kit components,...

30 Sep 32min

1042: Is the Jev Hype Overblown?

Is Jev actually a leap forward for classification or just hype and fake demos? We dig in, plus Claude Code’s new AGENTS.md support, TinyCast (the free, open-source Raycast alternative), an iPhone Fold...

28 Sep 1h 22min

1041: What are normies using AI for?

Scott and Wes talk about how non-developers are actually using AI today. They also cover the stuff they don’t think holds up, like AI-staged listings and automated marketing. Show Notes 00:00 Intro...

23 Sep 47min

1040: Developing for the iPhone Duo

Scott, Wes, and CJ break down developing for the iPhone Duo with the Device Posture and Viewport Segments APIs, plus the React 19.3 release and Pi’s new Radius platform. Also on deck: Tailwind joining...

21 Sep 1h 33min