scurvy_steve

6 ms·

1. 1.▲
   by scurvy_steve 3y ago

   I work on low code cloud ETL tools. We provide the flexibility for the customer to do stupid things. This means we have extremely high variance in resource utilization. An on demand button press can start a processes that runs for multiple
2. 2.▲
   by scurvy_steve 3y ago

   First, just don't enable implicit grant. That makes it a lot harder to screw up. State is for preventing CSRF, not transferring data. Don't abuse state, it's wrong. Use your own authorize url, add an encrypted cookie and redi
3. 3.▲
   by scurvy_steve 3y ago

   They are adding a second redirect on top and sticking it into the state parameter, presumably so they can redirect to anywhere. so the flow wanted was Go the some harvest authorize url, That redirects to the Microsoft authorize url with re
4. 4.▲
   by scurvy_steve 4y ago

   It uses what's sometimes referred to as WTF-16. It's UTF-16 but with no actual guarantee that its well formed(i.e. invalid surrogate pairs).
5. 5.▲
   by scurvy_steve 5y ago

   - Always use a response envelope I would mostly agree except in 1 case, streaming data is easier without an envelope. Making some array inside an envelope stream is usually more code and messier than just getting some metadata out of header
6. 6.▲
   by scurvy_steve 5y ago

   I have an app based around some long running resource intensive processes that run on scalable microservices. So you click a button and may have to wait 5+ minutes before you get a response. Websockets let you do notifications and make ever