all docs talk about servlets, but since I use spark, all routing is done inside the code

but then what is it if it's not a server?

thanks everyone, all got to work!

@gimjon has left the channel

hi all!

wanted to ask what the preferred way of doing user authentication is

I use wildfly 9, but that should not be important

'I see two options:

1) check users against a database inside my get methods

2) provide a user database to wildfly to check against, but that seems to be complicated\unfriendly

what do people usually do?

are there any major performance\security issues at 1 vs 2 ?

I know it works much easier for non-java server frameworks

thanks

nevermind, it seems I found the answer

@voddan: it is best to use OAUTH if the user base has existing accounts on big networks like Google, Facebook, LinkedIn, GitHub. There are good libraries out there and it is better than you trying to be secure with people’s passwords (which most people aren’t who write their own and don’t thoroughly understand cryptology)

@apatrida: hm, interesting. Our app will need phone numbers, everything else is optional. I thought facebook/twitter accounts didn't provide enough user info

first law of security - never ever implement security yourself

😄

@voddan: you can do the login through OAUTH then add extra data in your database. You can tie the two together.

Yep, that’s what we are doing for internal portal.

Also, just saying, ktor recently got auth implementation for basic, digest, oauth1b and 2 😉

<!here|@here>: If you are using sessions in your http backend, what kind of sessions they are and how do you use them?

@orangy: we have SMS login without a password which will create a session with a token and additional information to authenticate requests from then on.

@andreasbackx: do you store sessions on server? or stateless in cookies?

@orangy: we store them on the server as it's a REST API.

@orangy: we use sessions on the server clustered, which includes sessions from various types of clients. Our web ones COULD be stored in cookies since we are https and could trust them or use JWT

Why you guys choose kotlin for server engineering rather than scala?

what’s the benefit you think?

cause it’s easier than scala to learn?