Ask HN: What do you use for authentication and authorization?
Hard to say without more concrete details, but if I had to reply in broad strokes:- For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1]- For web, deploy a preloaded Strict-Transport-Security header [2]- For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over port 80 revoke that token).- If you go with OpenID/Oauth for client sign-ins then require https callbacks and provide scoped permissions.- Don't use JWT [3]. Don't use CORS [4].Again these are broad strokes - if you gave more information you'd get a better response.[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...[3]: https://en.wikipedia.org/wiki/JSON_Web_Token[4]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS