New answers tagged web-applications
1
This is in fact quite common, but I don’t believe there is a general guideline, as the details depend upon each situation. But there is at least a couple of key points to remember.
There are two kinds of impersonation, in production and in development. In a complex environment, where you have multiple user roles and abilities, impersonation in development ...
2
You are right. But what you manager really means is "if a user has a bug or problem I want to be able to reproduce it so I can help them solve it"
I would recommend you setup a number of test users with varying scenarios. Locked out, Zero balance, Cancelled Order, whatever this should enable you to check those scenarios for bugs and to check what ...
2
Typically this is not accomplished by impersonating another user. Instead, customer support staff are granted permissions to modify customer data. Any modifications should record the date and time of modification, and who modified it. Recording information about who and when data is modified is critical in cases where something didn't go right, whether by ...
3
The choice that you are making is the choice between a multi-tenant application or supporting multiple dedicated instances of the same application.
At such an early stage, I'm not sure if you should be concerned with the amount of data that would be required causing a decrease in performance. Databases, like Postgres, have a lot of effort put into their ...
-1
GPL is not recommended for scripting languages, such as JavaScript and Python. Unless you are sure these codes will not be used as a library.
Because GPL treats these non-binary executable code as source code, even if you minify or obfuscate them. While you are referring a script which is licensed under GPL, you have to open your source code of the entire ...
1
There are a lot of ways to do it, depending on your requirements.
I do this by returning the UI URL from the login request as follows...
User navigates to the app in the browser.
App's current version is retrieved (possibly from cache) and loaded.
Login page is presented because user is not logged in.
This means all users who visit our service without a ...
1
As already mentioned in the comments, one way to solve the whole problem is with the API Gateway. In it, the gateway checks for each request whether the JWT is included in the blocklist. If yes, the request will be rejected immediately with 401 or similar.
If a user logs out, the gateway adds the token to the blocklist and forwards the request to the auth ...
0
Edit: From the question I understood that blacklisting is only required to invalidate tokens on logout. In that scenario, the following solution allows you to achieve the result of sharing blacklisted tokens without actually using a blacklist.
One effective approach I have been using that does not require Redis or a list of invalid tokens utilises just a ...
Top 50 recent answers are included
