February 2023 Summaries

During a Christmas break exploration of serverless and infrastructure advancements, the author delved into Cloudflare Workers, Ory.sh, and PlanetScale, encountering a notable issue with Cloudflare Workers' library support due to its V8 engine, which does not support some Node.js NPM modules like Axios. This limitation affected libraries such as @ory/client that rely on Axios, leading to errors when attempting to run them on Cloudflare Workers. To resolve the issue, the author implemented a solution using the @haverstack/axios-fetch-adapter, which allows Axios to utilize Fetch APIs instead of its default Node-dependent adapter. This approach involved modifying the Ory API configuration to include the adapter, enabling Axios-based modules to function correctly within Cloudflare Workers. The author shares detailed implementation steps, including middleware setup with itty-router, to authenticate Ory sessions via cookies and ensure the proper operation of Axios-based requests in this serverless environment.

Over the past few years, the landscape of authentication methods has evolved beyond traditional password-based systems due to their vulnerabilities. This discussion explores various authentication factors, including "something you are" (biometrics), "something you have" (physical tokens), and "something you know" (passwords and PINs), each with its own advantages and drawbacks. Biometric authentication, while secure, can suffer from false positives and negatives, whereas physical tokens can be stolen or lost. Passwords and PINs are vulnerable to guessing and social engineering but remain a staple in multi-factor authentication due to their familiarity and ease of use. Alternative methods such as magic links via email, login codes, and newer technologies like WebAuthn offer passwordless solutions, although they come with their own challenges, such as email deliverability issues and limited cross-domain capabilities. The article emphasizes the importance of combining multiple authentication factors to enhance security and protect against cyber-attacks, while also acknowledging the trade-offs between security, convenience, and usability. Solutions like Ory provide customizable authentication frameworks that support various secure methods while avoiding outdated practices such as security questions, offering businesses flexibility in meeting their specific security needs.