Hacker News Reader

Comment by SahAssar | Hacker News Reader

I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these:

https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk...

For me it is also a red flag to include third party CDN JS (especially without SRI) on security critical applications (like the login for the dashboard and customer logins do with jsdelivr).

View on HN

Thank you for calling out the headers. We'll work to resolve right away.

And agreed on the CDN JS. We'll move these assets to the customer's domain.

It’s a great idea, but your company is going to be a serious target. You not only will have the ability to control authN, but you’ll own authR also if you’re managing users and groups. You’ll also own all the conference rooms, printers, servers, etc., since you’ll be hosting Active Directory for the Windows folk... at least that’s how I’d understand user management for auth.

Is authR another way to say authZ? I've never heard of authR and a quick google seems to mostly show a cloudflare project and stuff related to the term "author".

I took it to mean authz. Never seen authR before either.

It seems to be the new way to say it. I've known both as AuthN and AuthZ but AuthR picked up for some reason or another.

In the same vein, it seems like a lot of people aren't too aware of the "identity" space so there's a whole lot of re-inventing the wheel with external sources not realizing something already exists.

I think authN is Authentication and authR is authorisation. Two related but slightly different concepts. The third of the trio is Accounting which completes the AAA, the family of protocols that mediate access on the internet [0]

[0]: https://en.wikipedia.org/wiki/AAA_(computer_security)

edit: added reference and context for completion.

> For me it is also a red flag to include third party CDN JS

Why anyone would use third party js for anything other than dev work is beyond me. Are people really building websites that can serve html, images, and css, but not js?

There was the use case at one point that serving a version of a popular 3rd party JS framework from a CDN would result in the likelihood of that file being able to be served from the browser's cache, because there would be a decent chance the end user had visited some other site that used the same popular framework.

That no longer works, see https://www.stefanjudis.com/notes/say-goodbye-to-resource-ca... and https://developers.google.com/web/updates/2020/10/http-cache...

I think that most 3rd party providers say "DON'T HOST THIS FILE LOCALLY AS IT WILL BREAK WHEN WE MAKE UPDATES".

Which of course makes no sense. Why would any action they take have anything to do with a website that isn't hosting their files.

Well, if the JS is to connect to an end-point on their server (eg. Google Analytics) if they remove/deprecate the old API the JS file won't work anymore as it might not be compatible with the new API, so the JS file would have to be updated.

Oh sure! I guess we're talking about different things. In your example, Google is providing you a service, and they're serving the file.

I was talking about using 3rd party file hosting services like cdnjs.com and unpkg.com

It's gotten so bizarre that highly popular libs (even Facebook's React!!! )will recommend you hotlink these third party sites rather than give you a zip file to download and host yourself.

Oh yeah, that use case is weird, and as another comment mentioned it no longer brings the benefit of caching.

It's not an especially good look, although I see in the past few minutes HSTS has been enabled!

It's the same as before, clerk.dev does not have it and dashboard.clerk.dev had HSTS when I checked first too. HSTS is sorta irrelevant for .dev though since all of .dev is on the preload list in major browsers. I'd be more worried about the third party JS without SRI. Especially since including third party JS is an active choice while not having headers is an inactive one.

Also eyeballing the team, looks like nobody in particular has a security background. Worrisome...

Reply on news.ycombinator.com