@gfredericks: if something weird were happening, it would be hard to notice unless you had code that depends on the namespace reload order to function properly.

Nope I don't do any reloading

Has anyone here rolled their own authentication/authorization system with sente? I’m developing an SPA and want to use websockets exclusively for all communication on the server. I think I understand what I need to do, but just wanted to run my logic by someone else to make sure it’s sound.

APP INIT: • Check localStorage for previous app state, if found restore • If JWT token is found and expiration date is still valid, initiate sente connection [:handshake [:jwt jwt-token]] • Server authenticates the JWT token and sends back updated data to the client • Client resumes the UI to wherever they left off with the updated state APP LOGIN: • Assuming no local state was found or the JWT token had expired, show login screen • initiate sente connection [:handshake [:login uid device-id bcrypted-password]] • server verifies the bcrypted password matches the db password, saves the JWT token in the database along with the device-id (update-in db [:users :uid :device-id :jwt] jwt-token) and completes the handshake • App stores the JWT token and sends it along in all future sente communication APP LOGOUT: • notify the server to delete the JWT token • delete all localStorage state SERVER: • only store the users bcrypted password and the most recent JWT tokens [:device-id :jwt] • new sente connections: verify the JWT token is valid AND that it matches the database version (during handshake) • existing sente connections: verify the JWT token on every request. Every so often (once an hour?) create a new JWT token extending the expiration date (refreshing the token). Update the db with this new JWT token and send the new token back to the client GOALS: • secure, but not annoying to the user (heavy users only login once per device and their sessions extend indefinitely) • minimize hitting the database on every request (hence JWT) • be able to remotely log users out (via dropping the sente connection and deleting the JWT token from the database)

@seantempesta sounds good, except maybe for the part where I think JWT is nonsense

just let the server generate a unique token on login and send it to the client

which then stores and sends it in place of a JWT

no worries about a JWT impl, same effect

but if you have it running you can probably use it 😉

@thheller: Thanks! So you there’s no benefit to using JWT? I just kept running into it when researching best practices.

oh and you didn't mention SSL, which of course is mandatory no matter what

oh, of course

everything will be running over SSL

excellent, it is then safe to just [:handshake [:login uid device-id plain-text-password]] as well

and do the bcrypting on the server

well kinda safe 😉

probably best to do it on the client

yeah, I wasn’t sure about that. I figured if my server ever got hacked then I could at least prevent the attacker from ever knowing their original password

yeah it is better to do it on the client

just requires the client to have a bcrypt impl 😉

and they all sucked last time I checked

ah, I see. I’ll look around.

Thanks for the feedback!

curious though: why websocket only?

you need to account for random connection losses

especially for mobile clients

I’m doing a datascript <-> datomic sync based app. So I don’t really have API endpoints and really need to push updates to the client.

ah ok

still websockets can be kind of icky with mobile

server-sent-events yay

Is there a problem with websocket reconnects? On reconnection I’m just going to have the client send :database-last-sync-time #inst …, then I’ll push down any changes in bulk and then resume streaming updates.

yeah not a problem, just something to be aware of

also mobile clients will interrupt websockets on sleep

not sure how important mobile is to you

can you explain what you mean by interrupt on sleep? Like the client won’t get updates if the app isn’t open?

This is a react native project, so yes mobile is very important to me. 🙂

hmm no idea about react native

mobile browsers close websockets when selecting a different tab or when locked

they really don't like open network connections since they need to keep the radio on

which drains battery

which sucks

so they kill connections asap

but again .. no idea how react native handles this

yeah, I’ll have to look into this

but in general you want mobile clients to idle as much as possible

saving battery matters 🙂

very true. I don’t really care about background updates, but I wanted the UI to be realtime whenever it’s open. I figured websockets were the best solution, but maybe I should look into push notifications instead.

well you really only need to update the UI when the user is using it

so if you implement a re-connect logic like you suggested you should be fine

just something I wasn't aware of when testing websockets on mobile

they disconnect a lot 😛

good to keep in mind!

i thought sente automatically attempts to reconnect?

anyone tried d3 + canvas?

i want to learn clojurescript and I think this would be a good example to reimplement at first http://bl.ocks.org/ashnur/raw/910a4fdc3556a32f435f248c04108c8f/

Hi everybody ! I'm facing a situation I don't understand. I'm compiling a clojurescript project in dev, pre-min, and min modes, these mode are repsectively optimised with :none, :whitespace, and :advanced, nothing extraordinary… It compiles well in all cases, but when I run the minificated one (`:advanced`) I get this error in my browser:

Importing test-only code into non-debug environment: goog.testing.PseudoRandom(…)

@ggaillard something must be doing (:require [goog.testing.PseudoRandom])

or otherwise require a testing namespace

the warning is only emitted when js/goog.DEBUG is false

@ggaillard https://gist.github.com/thheller/57f9e3bf8c8b9f68b9225cfe2884e996 you can try this

no idea if other build tools offer this API

just run it in a REPL, it will tell you which namespace is using the goog.testing.PseudoRandom

Has anyone here done any beat detection stuff with Clojurescript? I'm just looking at the different javascript libraries out there, but I'd like to hear your thoughts

sorry maybe I should've posted this to clojure-art 😛

I detect beats with my ear and central nervous system

@raynes 😛

can't find one example of clojurescript + d3 + canvas

and nvim-parinfer touches the file, so i always have to save before i switch buffers, and it's really annoying

@thheller awesome thank you !