If we put export
in front of a named entity inside a module, it becomes a named export of that module. All other entities are private to the module.
//===== lib1.mjs =====
// Named exports
// MIT License | |
// | |
// Copyright (c) 2023 Lee Kah Seng | |
// | |
// Permission is hereby granted, free of charge, to any person obtaining a copy | |
// of this software and associated documentation files (the "Software"), to deal | |
// in the Software without restriction, including without limitation the rights | |
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
// copies of the Software, and to permit persons to whom the Software is | |
// furnished to do so, subject to the following conditions: |
TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.
If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)
A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/
The reason to avoid JWTs comes down to a couple different points:
node: Platform built on V8 to build network applications | |
git: Distributed revision control system | |
wget: Internet file retriever | |
yarn: JavaScript package manager | |
python3: Interpreted, interactive, object-oriented programming language | |
coreutils: GNU File, Shell, and Text utilities | |
pkg-config: Manage compile and link flags for libraries | |
chromedriver: Tool for automated testing of webapps across many browsers | |
awscli: Official Amazon AWS command-line interface | |
automake: Tool for generating GNU Standards-compliant Makefiles |
version: '2' | |
services: | |
nodered: | |
image: nodered/node-red-docker:0.17.5 | |
restart: always | |
environment: | |
- TZ=America/Montreal | |
logging: | |
driver: syslog | |
options: |
/** | |
* Fancy ID generator that creates 20-character string identifiers with the following properties: | |
* | |
* 1. They're based on timestamp so that they sort *after* any existing ids. | |
* 2. They contain 72-bits of random data after the timestamp so that IDs won't collide with other clients' IDs. | |
* 3. They sort *lexicographically* (so the timestamp is converted to characters that will sort properly). | |
* 4. They're monotonically increasing. Even if you generate more than one in the same timestamp, the | |
* latter ones will sort after the former ones. We do this by using the previous random bits | |
* but "incrementing" them by 1 (only in the case of a timestamp collision). | |
*/ |