S
Stormpath Blog
stormpath.com · Company blog · on HN since 2012
Stormpath, an authentication and user management service for developers, blogs about API design, JWT storage, security and its own engineering practices.
What HN saysHN links its JWT storage post, which commenters cite for recommending HttpOnly secure cookies; the comments also include its hiring posts and a shutdown notice.
69HN people shared it
22linked it in comments
125stories submitted
929story points
4 years agolast shared
2012people per year2026
Most-shared posts
- 1Homepage9 people · first shared 2013
- 2Where to Store Your JWTs – Cookies vs. HTML5 Web Storage8 people · 5 points · first shared 2015 · 1 comments on HN
- 3So Long Scrum, Hello Kanban4 people · 35 points · first shared 2014 · 9 comments on HN
- 4Sales for Hackers3 people · 124 points · first shared 2014 · 22 comments on HN
- 5API Driven Development3 people · 18 points · first shared 2014 · 4 comments on HN
- 6The Ultimate Guide to Deploying Static Sites on AWS3 people · 12 points · first shared 2017 · discussion on HN
- 7Designing a Beautiful REST + JSON API3 people · 5 points · first shared 2013 · discussion on HN
- 8Secure Your REST API2 people · 117 points · first shared 2013 · 74 comments on HN
- 9Okta Acquires Stormpath2 people · 40 points · first shared 2017 · 18 comments on HN
- 10Linking and Resource Expansion: REST API Tips2 people · 10 points · first shared 2013 · discussion on HN
- 11Build a Node API Client – Part 1: REST Principles2 people · 6 points · first shared 2014 · discussion on HN
- 12To PUT or POST?2 people · 5 points · first shared 2013 · discussion on HN
- 13Why HTTP Is Sometimes Better Than HTTPS2 people · 5 points · first shared 2015 · discussion on HN
- 14Long Live The Password2 people · 5 points · first shared 2013 · discussion on HN
- 15What the Heck Is OAuth?2 people · 5 points · first shared 2015 · 1 comments on HN
What HN people wrote when they linked it
sar415a · 2016-10-07
Stormpath | San Mateo, CA | https://stormpath.com | Full-time | Onsite
Position: Dev Ops Engineer
Stormpath is an authentication and user management service that helps developers quickly and securely build web and mobile applications.
Come join a team where you can have huge impact! We're looking for a versatile DevOps engineer to work primarily with Linux/AWS/Chef/Docker to support a Java environment.
We hire smart, fun, humble, and passionate people who love what they do and deliver quality work. We're trying to achieve something great, with great people.
Interested? Apply through our website or e-mail me directly: [email protected]
rdegges · 2016-07-01
Stormpath | San Mateo, CA | full-time | onsite (or remote) | https://stormpath.com
We're hiring a developer evangelist (javascript) to come join my team and build open source security and authentication libraries! If you're interested in making it simpler to register users, log them in, and handle everything around user accounts and user data: this is the position for you! <3
You'll basically be doing stuff like:
* Giving tech talks at conferences, meetups, etc.
* Recording screencasts / videos, teach people how to do stuff.
* Writing educational articles about web security, best practices, etc.
* Working on open source software.
Hit me up directly if you want to chat! [email protected]
chunsaker · 2013-04-01
Stormpath (http://www.stormpath.com)
* We have roles open for core Java engineers, a Data Guru and a Developer Evangelist (Python, Ruby, PHP, Haskell...)
Stormpath is the first easy and secure user management and authentication service for developers. Fast and intuitive to use, it offers an easy API, open source SDKs, and an active community.By offloading user management and authentication to Stormpath, developers can bring new applications to market faster, reduce development and operations costs, and protect their users with best-in-class security.
We're well-funded, friendly and located in gorgeous downtown San Mateo near the Caltrain. Drop us a note if you think what APIs - even if there isn't a job listed that fits your bill. [email protected]
mythz · 2018-08-30
Storing JWT's in a HttpOnly Secure Cookie is common and recommended for Web Apps.
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-w…
mluggy · 2017-08-09
funny how you're right. i just got an api shutdown notice from stormpath (yet another product that supposed to save us developers): https://stormpath.com/
komerdoor · 2017-05-08
I am using JWT for my projects to keep stateless sessions between servers and for some other
tokens (refresh, register, reset pass etc.). Of course extra security measures are required (MitM protection [HTTPS etc.], XSS / CSFR prevention etc.), but this has nothing to do with JWT. I use encryption with a frequently rotated private key to encrypt the part of the payload that only the server may read.
A good read at:
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-w…
danjoc · 2016-09-02
I consider cookies much more secure than the alternatives. Here's a detailed explanation as it relates to JWT. The main takeaway is, if properly configured by the site, cookies are more secure than alternatives like web storage.
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-w…
But that's coming from a site admin point of view. As a user, it would be great to have a browser plugin that allows me to reject cookies that aren't secure/httponly.
hkarthik · 2015-06-21
StormPath (https://stormpath.com/) can probably achieve what you want. It's not part of AWS, but available through the AWS marketplace: https://aws.amazon.com/marketplace/pp/B00CX845OE/
jnord · 2014-05-20
While perhaps not a Java webapp, Stormpath offers a User Management API that may fit your need:
https://stormpath.com/
qw · 2014-04-13
I was planning to make something like that myself, but there seems to be plenty of competition from https://stormpath.com/ and others
Keats · 2013-10-28
This is probably my favourite talk on the subject : http://www.stormpath.com/blog/designing-rest-json-apis
Lord_Zero · 2016-10-24
Can anyone check if https://stormpath.com/ has this issue?
dbolgheroni · 2017-12-13
This blog post has a good explanation:
https://stormpath.com/blog/sso-vs-centralized-auth
TeMPOraL · 2017-08-09
The announcement post[0] seems to be from March, which would give one about 4.5 months to migrate.
--
[0] - https://stormpath.com/blog/stormpaths-new-path
jamier1978 · 2017-03-06
According to the FAQ they will be shutting down the Stormpath API in 6 months. https://stormpath.com/oktaplusstormpath
FAQ also says you will need to export your data from SP and, presumably, manually import it in to Okta. If thats the case its going to be hard to do it without end user disruption.
abraae · 2017-03-01
Read-only or not, its still part of the resource, and so PUT must supply it. Here's a nice writeup: https://stormpath.com/blog/put-or-post
EdJiang · 2016-06-28
I wrote this post the other day comparing four of the top Swift web frameworks on GitHub, maybe this will help?
https://stormpath.com/blog/swift-on-the-server-today
Be aware that all of the frameworks are targeting Swift 3 right now, so it's a bit unstable until Swift 3 is officially released. But the ecosystem is going really strong =]
neya · 2016-06-13
I am writing my own framework in Scala and I found a similar good article on this topic:
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-w…
But then, I'm now even more confused as the others here. How exactly am I supposed to secure my REST API now?
onurozkan · 2016-04-06
Here is some services might be useful for you.
- https://aws.amazon.com/cognito/ (not sure)
- https://stormpath.com/
- http://janrain.com/
- https://www.userapp.io/
- https://www.onelogin.com
omgitstom · 2015-04-01
https://stormpath.com/blog/why-http-is-sometimes-better-than-https/
Compelling argument why your app should use HTTP instead of HTTPS
grosskur · 2013-11-20
"Designing REST + JSON APIs" by Les Hazlewood is a good starting point:
http://www.stormpath.com/blog/designing-rest-json-apis
skynode · 2017-05-09
For traditional sessions:
1. All You Ever Wanted to Know About Sessions In Node.js (Stormpath) - https://stormpath.com/blog/everything-you-ever-wanted-to-know-about-no…
2. Express.js Production Best Practices - https://expressjs.com/en/advanced/best-practice-security.html
3. express-session (npm module) - https://ewiggin.gitbooks.io/expressjs-middleware/content/express-sessi…
4. Node.js authentication strategy using Passport.js and Redis - https://blog.risingstack.com/node-hero-node-js-authentication-passport…
For JSON Web Tokens:
1. JWT Handbook: https://auth0.com/e-books/jwt-handbook
2. IETF Specification: https://tools.ietf.org/html/rfc7519
3. https://jwt.io/
4. Authentication in React Applications, Part 2: JSON Web Tokens - https://vladimirponomarev.com/blog/authentication-in-react-apps-jwt
6. Token Authentication Implementation - https://docs.docker.com/registry/spec/auth/jwt/
7. JWT Validation and Authorization in ASP.NET Core - https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-…