Hacker News Reader

The author kinda lost me halfway through. Was mobile or other non-web API interaction ever addressed in any meaningful way? Specifically, how much it sucks to to allow 3rd parties (or even 1st-party non-web-browser clients) access to your API if authentication is done via session cookies? Cuz that's a pretty significant thing to just gloss over.

View on HN

Thanks for the comment! I didn't cover that in this talk as it was written for a 1 hour timeslot and already ran long.

I have separate content which addresses these topics in more depth.

Thanks, I look forward to reading it!

OAuth is a pretty popular option for delegation... and JWT isn't really necessary there...

Reply on news.ycombinator.com