W
@Ben-Hayat So, this has gotten me to work. I decided to rebuild my company website using Quasar, with directus (https://directus.io) as the backend (it has quite a full featured API, including a JavaScript SDK which I used, and has authentication built-in).
Let me know your feedback on the UI:
https://customautosys.com/new (new Quasar UI)
https://customautosys.com (old UI)
@qyloxe said in Would you use Vue + Quasar to build a Marketing site?:
@stefanvh said in Would you use Vue + Quasar to build a Marketing site?:
@Ben-Hayat I don’t want to hijack your topic so let me know if I have to move this discussion somewhere else.
I’m also feeling uncomfortable here…
So, for example simple blog functionality. There needs to be a way to authenticate the user with an username and password. The authentication returns an authorization token. With the authorization token the user should be able to create a blog post (e.g. POST /posts). Unauthenticated people should be able to retrieve this post (e.g. GET /posts or /posts/1). This post is prefetched in Quasar and then displayed in a QCard for example. JSON-API covers creating and fetching resources (the posts), but authentication and even authorization can be performed in a billion different ways. Personally I am using PASETO tokens and /login and /register routes with simply {username, password} as payload with the appropriate HTTP status codes as response. But there are a lot of other ways (http://www.passportjs.org/packages/).
anyway, this scheme could be vulnerable to CSRF family of attacks. You need secure, same-site etc. cookie. Every other client side token, visible to JS is a potential vector of attack. If it is a blog for cats stories I wouldnt worry of course, but if it is a blog for bank official statements - this is another story. Do you know who your target is?
Well, the words are cheap and misleading. We, as developers has a opportunity and privilege to talk precisely and exactly about topic - we can use the language of code. So, please just create a repo on github, put your words into action and just create a skeleton, template, base of your thoughts in material (as in computers haha) form. It is much easier to discuss code in specific context than just dream about any possible or maybe possible context. At the end of the day, you will need to make a technical decision.
Authentication is a problem that has been solved by many other companies. Don’t reinvent the wheel. There are solutions like Auth0 & Okta, just to name 2 of the most common ones. Using a tried-and-tested authentication provider is probably more secure and less susceptible to CSRF than anything a solo dev could churn out.
