Alex Crocker crock

Goal

use Auth0 for logins
retrieve a Fauna instance secret for the user (see Fauna's ABAC tutorial)
have the user’s device talk directly to Fauna's native graphql endpoint using their secret for authorization.

Solutions

At the very least, we need two pieces of functionality:

Create a user document in Fauna to represent each Auth0 user.
Exchange an Auth0 JWT for a FaunaDB user secret.

Stop using JWTs!

TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.

If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)

A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/

The reason to avoid JWTs comes down to a couple different points:

The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions

	import SwiftUI

	extension Text {
	public struct InlineSymbol {
	public let name: String
	public let accessibilityLabel: String
	public let color: Color?

	public init(name: String, accessibilityLabel: String, color: Color? = nil) {
	self.name = name

	import SwiftUI
	import SafariServices
	import PlaygroundSupport

	// lil news api
	let apiURL = "https://api.lil.software/news"

	struct News: Codable {
	var articles: [Article]
	}

	const MY_DOMAIN = "help.splitbee.io"
	const START_PAGE = "https://www.notion.so/splitbee/Help-Center-bbf26e2b70574901b9c98e5d11e449de"

	addEventListener('fetch', event => {
	event.respondWith(fetchAndApply(event.request))
	})

	const corsHeaders = {
	"Access-Control-Allow-Origin": "*",
	"Access-Control-Allow-Methods": "GET, HEAD, POST,PUT, OPTIONS",

	// create context with no upfront defaultValue
	// without having to do undefined check all the time
	function createCtx<A>() {
	const ctx = React.createContext<A \| undefined>(undefined)
	function useCtx() {
	const c = React.useContext(ctx)
	if (!c) throw new Error("useCtx must be inside a Provider with a value")
	return c
	}
	return [useCtx, ctx.Provider] as const

	pv_paypal
	pv_shop_name
	pv_shop_slug
	pv_shop_description
	pv_seller_info
	_wcv_store_city
	_wcv_store_state
	_wcv_store_country
	_wcv_store_postcode
	_wcv_shipping

	execute pathogen#infect()

	set nocompatible
	filetype off
	syntax enable
	syntax on

	let g:solarized_termtrans = 1
	set background=dark
	colorscheme solarized


	<a href="javascript:gaOptout()">Click here to opt-out of Google Analytics</a>

	<script>
	// Set to the same value as the web property used on the site
	var gaProperty = 'UA-XXXX-Y';

	// Disable tracking if the opt-out cookie exists.
	var disableStr = 'ga-disable-' + gaProperty;
	if (document.cookie.indexOf(disableStr + '=true') > -1) {