The State Changers meeting was focused on discussing user authentication issues in relation to applications using Xano. The main topics discussed were issues with Xano's authentication endpoint, the use of OAuth tokens and JWT tokens, the importance of data security, and understanding authentication flows.
Key points from the meeting are as follow: - Xano's authentication endpoint was not showing up in the request history in certain use cases, causing difficulties in debugging. - Auth tokens were successfully used in the front end, but seem to fail when employed from Xano. - The group stressed the importance of knowing that any information sent to the front end can be exposed, hence always considering security during the design and implementation of authentication flows. - JWT tokens were discussed as a potential solution for securing user's information as they authenticate. - However, they also explored simplifying the process by utilizing Xano's built-in functionality and trusting the access tokens to do the job of securely identifying users. - The necessity of managing the refresh tokens was also discussed. Refresh tokens, generally stored in the database, become a helpful tool in limiting potential damage in case of compromises as they are revocable. - It was also suggested that limiting token duration, access control, and having a reliable audit system could enhance security. This meeting will be helpful for developers or teams who are struggling with user authentication issues or trying to increase the security of their Xano based applications. No other tools (WeWeb, FlutterFlow, Zapier, etc.) were discussed in this meeting.
(Source: Office Hours 6/19 )
