Ask HN: What do you use for authentication and authorization?
Hard to say without more concrete details, but if I had to reply in broad strokes:<p>- For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1]<p>- For web, deploy a preloaded Strict-Transport-Security header [2]<p>- For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over port 80 revoke that token).<p>- If you go with OpenID/Oauth for client sign-ins then require https callbacks and provide scoped permissions.<p>- Don't use JWT [3]. Don't use CORS [4].<p>Again these are broad strokes - if you gave more information you'd get a better response.<p>[1]: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...</a><p>[2]: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...</a><p>[3]: <a href="https://en.wikipedia.org/wiki/JSON_Web_Token" rel="nofollow">https://en.wikipedia.org/wiki/JSON_Web_Token</a><p>[4]: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS</a>