August 2022 Summaries

PropelAuth has introduced UI and feature updates for its hosted authentication pages, which provide a full authentication experience without requiring customers to build the interfaces themselves. The pages are designed to let users manage account and organization details independently while applications primarily manage user IDs, organization IDs, and roles. Updates improve handling of incomplete signup information from passwordless or social login flows by prompting users for missing details, and expand customization options for borders, fonts, and background and foreground colors to better match product branding. Hosted Organizations pages now support member search and filtering, invitation rescission, and automatic organization enrollment for users sharing an email domain. The company has also launched a changelog for ongoing product announcements and beta-release updates.

PropelAuth has released a Migration API intended to help companies move from custom or third-party authentication systems with minimal user disruption and no downtime. The API supports transferring password hashes, existing user IDs, metadata, two-factor authentication-related account properties, organizations, user memberships, and role-based access controls, while linking legacy IDs to PropelAuth IDs for compatibility with existing databases. Backend libraries include a migrateUserFromExternalSystem function, and migrations can be tested in a non-production environment before deployment. PropelAuth positions the feature as an option for organizations that have outgrown their current provider, face rising costs, or need B2B-focused authentication capabilities, while offering documentation and support assistance for the migration process.

Setting up a first JavaScript repository involves choosing a code editor such as VS Code, selecting a package manager like npm, Yarn, or pnpm, and initializing a project with npm to generate a package.json file. The walkthrough builds a simple web app that displays and updates the current time, using Parcel as a low-configuration bundler with browser compatibility settings and a local development server. It also recommends ESLint and Prettier for maintaining code quality and consistent formatting, configured through npm scripts and project-level linting settings. Git is initialized with a suitable .gitignore file, while Husky pre-commit hooks are used to run linting before commits and can optionally discourage direct commits to the master branch. Because local hooks can be bypassed, remote GitHub branch-protection rules are presented as the more reliable way to prevent unauthorized direct pushes to the main branch.

Artemis founder Josh Gray and his three-person team chose PropelAuth to handle authentication and authorization while building their data infrastructure company’s minimum viable product. Because auth was necessary but not central to their roadmap, they avoided developing it internally and rejected Okta due to its engineering requirements and anticipated cost at scale. After discovering PropelAuth through a Y Combinator post, Artemis integrated the service in roughly a day and a half, with Gray configuring the interface and user schema before a developer completed the API setup. Gray also highlighted responsive support from PropelAuth founder Andrew Israel and said the service enabled Artemis to concentrate engineering resources on core product features as it prepared for a public beta launch.

Cross-Origin Resource Sharing (CORS) is a browser and server security mechanism that controls whether a web page can make requests to a different origin, protecting users from malicious sites exploiting authenticated cookies or other browser-held state to access sensitive data. Servers configure CORS rules through response headers to allow or deny particular origins, credentials, HTTP methods, and request types, while browsers enforce those rules. In a local React and Express example, applications running on different ports are treated as different origins, so a frontend on port 3000 requesting an API on port 4000 can trigger a CORS error. The preferred solution is to configure the backend, such as with Express’s CORS middleware, to explicitly allow the frontend origin. When backend configuration is unavailable or when frontend and backend should appear under one origin, React development proxies or Next.js rewrites can forward browser requests to the backend, preventing the browser from treating them as cross-origin.