Fork me on GitHub
Slack Archive

This page is not created by, affiliated with, or supported by Slack Technologies, Inc.

2019-03-28

Channels

#clojurescript
<
2019-03-28
>
maximtop08:03:00

Hi, everyone. Why do clojurescript adds redundant \? I have this regex 

(def youtube-regex #"(?:youtube\.com\/\S*(?:(?:\/e(?:mbed))?\/|watch\?(?:\S*?&?v\=))|youtu\.be\/)([a-zA-Z0-9_-]{6,11})")
(def youtube-link "")
(re-matches youtube-regex youtube-link)
console states about error Uncaught SyntaxError: Invalid regular expression flags and regexp looks like this 
chromex_sample.background.core.youtube_regex = /(?:youtube\.com\\/\S*(?:(?:\\/e(?:mbed))?\\/|watch\?(?:\S*?&?v\=))|youtu\.be\\/)([a-zA-Z0-9_-]{6,11})/;
Or above regexp has errors? sources are here https://github.com/maximtop/tabs-builder

maximtop13:03:53

Solution was found. Not like in the JS, ClojureScript escapes slashes himself. So i've removed all redundant escapes and now the regexp works as supposed to

Eric Scott12:03:17

@nathantech2005, @dnolen, @kwladyka, having slept on it, my eye went right to the problem -- I wasn't actually throwing the js/Error, I was calling it as a function. Having fixed that, this clause works just fine ... (is (thrown? js/Object (ig/unique #{:just-me :no-theres-me-too!}))). Before the thrown? was failing because it wasn't actually uh, thrown. Sorry for the confusion. Boy am I dumb. 😳

hipster coder15:03:27

Would you mind posting the old and new code... did you just need another ( ) ?

hipster coder15:03:00

Or 1 less ( )... calling it as a function

Eric Scott15:03:34

Sure. Old and bad: (let [error-msg (str "Non-unique: " coll)] #?(:clj (throw (Exception. error-msg)) :cljs (js/Error. error-msg) )) New and good: (let [error-msg (str "Non-unique: " coll)] #?(:clj (throw (Exception. error-msg)) :cljs (throw (js/Error. error-msg)) ))

Eric Scott15:03:59

I suppose I could also have moved one of the parens.

Eric Scott15:03:34

and the :clj reader macro

hipster coder15:03:24

ahh, makes a lot more sense, need the throw added in there

Eric Scott16:03:51

Yeah, and in retrospect the log traces pointed to this problem, but I'm just starting in with this javascript stuff, and I didn't know what I was looking at.

Eric Scott12:03:26

Thanks again for your help

👍 5
jaide15:03:40

Anyone experience a firefox issue where looping requestAnimationFrame seems to fire once every second? It’s fast on Chrome and Safari but crawls on Firefox. https://codepen.io/jayzawrotny/pen/XGLoKx?editors=0012

jaide15:03:46

Like in Chrome and Safari, 25 frames are logged in < 1 second. In Firefox it takes 25 seconds.

Jimmy Miller15:03:02

Looks like it might be codepen causing this behavior. Happens for me on your link but not in fullview. https://codepen.io/jayzawrotny/full/XGLoKx

Jimmy Miller15:03:07

Might be the iframe >You should call this method whenever you're ready to update your animation onscreen. This will request that your animation function be called before the browser performs the next repaint. The number of callbacks is usually 60 times per second, but will generally match the display refresh rate in most web browsers as per W3C recommendation. requestAnimationFrame() calls are paused in most browsers when running in background tabs or hidden <iframe>s in order to improve performance and battery life. https://developer.mozilla.org/en-US/docs/Web/API/window/requestAnimationFrame

jaide16:03:39

Interesting! Thanks for the help.

kwladyka18:03:18

What do you use for Single Page Application with Single Sign On? When add things like Access-Control-Allow-Origin, Access-Control-Allow-Credentials, redirections etc. to concern I am confuse about choose solutions and tools in Clojure / ClojureScript for this purpose.

kwladyka18:03:02

I have ring server BE and re-frame FE

kwladyka18:03:34

I read a lot in google and I am more confuse then before

kwladyka18:03:24

I need help to choose right solution 🙂

kwladyka18:03:33

At that moment I have http://auth.foo.com http://spa1.foo.com, http://spa2.foo.com etc. So everything is in one domain, but who knows the future

kwladyka18:03:10

So for example Access-Control-Allow-Credentials true will make an issue about inject JS in one of SPA, so I would like to avoid it. So what left? Only redirections can be consider as secure?

kwladyka18:03:48

So Oauth 2.0. with OpenID connect 1.0 ?

kwladyka19:03:04

But what libraries for clj support it for SPA SSO?

hipster coder19:03:47

If you ever run into cross domain problems... I hack it by hiding everything behind an nginx proxy

kwladyka19:03:05

What exactly do you mean?

hipster coder19:03:05

I can also bypass content site policiez

hipster coder19:03:21

Use nginx to bypass CORS

hipster coder19:03:50

Nginx can mask domains as the same domain

kwladyka19:03:15

so this proxy give what exactly? add cookie to headers?

hipster coder19:03:35

Hide the real domain. Pass thru. No header modifications.

hipster coder19:03:42

Helps solve CORS problems on API calls

hipster coder19:03:02

Makes the server think it is on 1 domain

kwladyka19:03:06

so you set cookies with domain:

kwladyka19:03:32

to read it from all subdomains

hipster coder19:03:53

Well... subdomains don't trigger cross site problems

hipster coder19:03:29

Only different root domains cause problems with CORS

kwladyka19:03:41

Hmm I am testing it locally by dev.localhost and I have to set Access-Control-Allow-Credentials: true to make it work

kwladyka19:03:01

I use the same domain, but different port

hipster coder19:03:05

On CORS? Let me check

hipster coder19:03:33

Ahhh ok... you are correct

kwladyka19:03:08

yes, I have this one too

kwladyka19:03:36

so it makes things complex and I am confuse about all this things to make it secure

hipster coder19:03:31

Request.credentials set to "include" is triggering it

kwladyka19:03:36

additional issue is redirection, so user come to http://spa1.foo.com/path, redirect to login to http://auth.foo.com, but needs to back to http://spa1.foo.com/path

kwladyka19:03:03

I would like to use library which already solved this issue, but I don’t see it for clj /cljs unless I don’t understand something 🙂

kwladyka19:03:51

> Request.credentials set to “include” is triggering it Yes I have it also set in FE

kwladyka19:03:00

there is only one way to make it work

kwladyka19:03:12

but it starts to be too complex about security in my feeling

hipster coder19:03:13

I think you need an RFC 5471 compliant library

hipster coder19:03:28

There is a new cross site solution being used but its brand new

kwladyka19:03:32

It will be great if you can recommend me something to use or tell how to do it right and secure.

kwladyka19:03:57

Do I need (want) OAuth2 for it? With OpenId connect 1.0?

hipster coder19:03:36

Oauth is more for 3rd party google logins

hipster coder19:03:53

Did you see the ring-cors library?

kwladyka19:03:03

but is solves redirections I guess, how can I deal with redirections myself?

kwladyka19:03:39

> Did you see the ring-cors library? I didn’t. I was focused on Single Sign On solution, but maybe I should make smaller steps, because there is no such library at that moment

hipster coder19:03:53

Terminology is called "single sign on"

hipster coder19:03:20

I guess Oauth does support it

kwladyka19:03:51

So… there is no other way: I have to care about Access-Control-Allow-Origin, Access-Control-Allow-Headers, Access-Control-Allow-Credentials myself using ring-cors or whatever solution. Additionally I have to care myself about redirections when login? Combining both I will solve my issue?

hipster coder19:03:00

I would have used nginx for this

hipster coder19:03:28

It takes away all the library dependent challenge problems

kwladyka19:03:53

you mean you will set Access-Control-Allow-Origin, Access-Control-Allow-Headers, Access-Control-Allow-Credentials by nginx proxy?

hipster coder19:03:57

I have bypassed CORS with nginx

kwladyka19:03:05

it still doesn’t solve issue about redirections

hipster coder19:03:11

No need to set CORS

hipster coder19:03:42

I'd have to check if nginx proxy can share sessions

hipster coder19:03:56

So redirection worls

kwladyka19:03:19

mmm but on dev.localhost I have to set all this parameters to work in the same domain, but different port.

kwladyka19:03:40

> No need to set CORS How is it work to not set it?

kwladyka19:03:24

The topic is much harder, than I expected

kwladyka19:03:51

I thought there is oauth2-clj library or something like that which just do the job

hipster coder19:03:14

It is involved

kwladyka19:03:59

Still I am not sure if solving CORS is really what I need to Single Sing On solution. I mean it is connected, but not sure if it is right way to achieve the goal.

kwladyka19:03:23

I mean maybe I should use OAuth2 library or something

kwladyka19:03:27

Does it make sense?

kwladyka19:03:34

As I understand OAuth 2 + OpenID Connect 1.0. do the job?

kwladyka19:03:39

Ech I am too confuse 🙂

hipster coder19:03:24

Yes. For redirects.

kwladyka19:03:31

Or I don’t need it as long as I use 1 domain and subdomains?

hipster coder19:03:34

It solves cross domain problem

kwladyka19:03:36

oh redirects, true

kwladyka19:03:12

so still do you recommend nginx proxy or OAuth2?

hipster coder19:03:20

I would have kept the auth server on the main domain

hipster coder19:03:49

Personally... I'd use nginx

hipster coder19:03:56

Proxy alias it

hipster coder19:03:14

But its my own hack... not standard

kwladyka19:03:31

why not oauth2?

hipster coder19:03:56

Because oauth2 will need libraries to support it

hipster coder19:03:10

If you can find stable library... then ok

kwladyka19:03:34

mmm probably my main issue is I can’t find libraries for clj / cljs for SPA 🙂

hipster coder19:03:56

How about raw JS libraries?

kwladyka19:03:11

I stuck on server side at that moment

hipster coder19:03:34

You can also load react libraries into cljs

kwladyka19:03:34

But didn’t look deep into raw Java

hipster coder19:03:09

But JS npm is always breaking stuff

hipster coder19:03:19

I'd prefer a server solution

hipster coder19:03:31

I'd test if clojure-cors can handle redirects

hipster coder19:03:44

Or move the auth server onto the main domain

hipster coder19:03:19

Is this for a company or just personal?

kwladyka19:03:26

I really want to avoid doing my own solution, because of security reason 🙂

hipster coder19:03:55

Ya... that's why I ask... what is it for

kwladyka19:03:21

well it is project which will became company if I will finish it 🙂 Besides of it I want to learn how do it right.

kwladyka19:03:35

Experience is in price 🙂

kwladyka19:03:59

But stuff about auth took my so long time

hipster coder19:03:03

Ok... move auth to main domain

hipster coder19:03:11

And use cors library

hipster coder19:03:30

Then you just need cors for any ajax calls

kwladyka19:03:41

+ redirections

hipster coder19:03:18

Redirection is from having a different auth system on a subdomain?

kwladyka19:03:15

But I am afraid about injecting JS a little. Some of this SPA will deal with JS rendering as template.

kwladyka19:03:29

it should be secured, but anyway it is something what I am afraid of

hipster coder19:03:40

Any templates need sanitized

hipster coder19:03:52

That is XSS attack

hipster coder19:03:48

If anything... allowing redirections opens up more security problems

kwladyka19:03:15

So that is why my first thought went to OAuth2

hipster coder19:03:22

Because I can authorize off that http://auth.foo.com server by middle man

hipster coder19:03:00

I can middle man attack if redirections are allowed

hipster coder19:03:27

Another reason to keep auth on the main domain

kwladyka19:03:56

Are you sure you are right? Then it will mean OAuth2 is not secure.

kwladyka19:03:08

it is probably about right solution

kwladyka19:03:17

not an issue in 100% cases

hipster coder19:03:49

Oauth uses a handshake

hipster coder19:03:00

It is not a 1 way message

hipster coder19:03:55

Better make sure to set HSTS too

hipster coder19:03:13

Or I can force drop SSL on a man in middle

hipster coder19:03:53

I hacked my own corporate logins before... no HSTS

kwladyka19:03:10

HSTS - thank, I don’t know this one

kwladyka19:03:13

cool, sounds good

hipster coder19:03:26

Ya. Don't do that unless you have a pen testing contract. Highly illegal.

kwladyka19:03:56

What do you mean?

kwladyka19:03:37

So summarise this up: 1) I can use http://foo.com and subdomains with Access-Control-Allow-Origin, Access-Control-Allow-Headers, Access-Control-Allow-Credentials, Strict-Transport-Security + care about redirections for login purpose. 2) OAuth2, but there is no library to recommend

kwladyka19:03:16

but it is client for ring

kwladyka19:03:25

I need server side for ring

hipster coder19:03:05

Oauth2 is really client side from my understanding

hipster coder19:03:17

Server side... would be things like sessions

hipster coder19:03:25

Shared sessions on the backend

kwladyka19:03:38

there is buddy, but authentication there is not for SPA SSO. Unless maybe use buddy for redirections (OAuth) but handle CORS myself hmm

hipster coder19:03:05

There is Oauth2 server side?

kwladyka19:03:06

yes, but also for redirections

kwladyka19:03:47

While it is for client, it needs to be for server too 🙂

hipster coder19:03:54

Ahhh I understand

kwladyka19:03:57

I need to do a break, it blows up my minds. Still not sure what to do. But maybe there is no ready to use full solution. Maybe I need to care about this CORS part myself

hipster coder20:03:09

You want to setup your own Oauth2 Server... gotcha

kwladyka20:03:16

exactly 🙂

kwladyka20:03:27

to solve SPA SSO issue

kwladyka20:03:34

it can be a solution

hipster coder20:03:36

I haven't done that, yet

kwladyka20:03:43

yeah me too 😕

hipster coder20:03:54

Sounds fun though

kwladyka20:03:57

but in theory it should solve redirections + Single Sing On

hipster coder20:03:25

Ya, take a break. Maybe we can collab on github

kwladyka20:03:29

But as I understand OAuth2 solutions can be different and do authentication in different ways

hipster coder20:03:58

Put your stuff on github

kwladyka20:03:59

And I didn’t find solution in clj / cljs for this

kwladyka20:03:16

> Maybe we can collab on github Sure 🙂

hipster coder20:03:33

Maybe community needs a library

kwladyka20:03:49

So as I understand the best will be OAuth2 + OpenId connect

kwladyka20:03:00

But I didn’t find this one

kwladyka20:03:28

> Maybe community needs a library At least I needs library or documentation how to achieve it in clj / cljs 🙂 But…. maybe I can just use Java library or something. I don’t know what is right way to do it.

kwladyka20:03:19

ok, I need to do a break. See you later 🙂

kwladyka20:03:38

If you figure out something let me know! 🙂

kwladyka19:03:28

Well… OAuth probably support it, but when looking closer on libraries there is no good support for SPA

dpsutton22:03:16

re-find says it returns a vector >> Returns the first regex match, if any, of s to re, using re.exec(s). Returns a vector, containing first the matching substring, then any capturing groups if the regular expression contains capturing groups. but (re-find #"ab" "ab") => "ab"

dpsutton22:03:10

but my real question is how to group things into an or clause without capturing. ie, (re-find #"(a|b)?c" "ac") without capturing junk but just the notion, "a or b or neither and a c". as the capturing group changes the return type from string to vector of string

jeffmad23:03:17

? a jittery lag ? like as you type in a text input the characters appearance is delayed?

ag23:03:01

yeah, something like this. This is from simulator - on a real device it’s way worse