September 2023 Summaries

In this blog post, the process of implementing an invite-only user authentication flow in a React app using SuperTokens is outlined. The app is set up with a React frontend and NodeJS backend, utilizing SuperTokens for email-password authentication. The guide explains how to disable the default sign-up functionality in both the frontend and backend by hiding the UI elements and overriding the API configurations. It details the creation of a protected API that allows only admin users to invite new users by generating and sending password reset links as invite links. The invitees must reset their passwords before signing in, preventing the use of a common fake password. The customization ensures that only invited users can access the app, providing a straightforward way to enhance user exclusivity and engagement.

SuperTokens, a managed service hosted primarily on AWS, undertook significant infrastructure changes to reduce its AWS billing by more than 50%. Initially, the service operated in two modes: a Development mode that efficiently ran multiple instances on a single EC2 T3.small instance and a Production mode that required separate EC2 T2.micro instances for each deployment, resulting in longer setup times. Early optimizations included creating a custom AMI with pre-installed Docker to reduce setup time for production instances. However, as user numbers and infrastructure costs increased, with AWS credits depleting, a more substantial change became necessary. The introduction of a multi-tenancy feature allowed for the consolidation of EC2 core instances, effectively cutting costs while maintaining performance, with further details of these changes to be explored in the series' second part.

Understanding HTTP status codes, particularly 401 Unauthorized and 403 Forbidden, is crucial as these codes indicate different access denial scenarios in web APIs. The 401 Unauthorized status code is used when a client has not provided valid authentication credentials, such as missing or incorrect passwords or expired tokens, meaning the server cannot identify the user. In contrast, the 403 Forbidden status code applies when a user is authenticated but lacks permission to access the resource, often due to insufficient user role privileges or IP blacklisting. The fundamental difference between the two lies in authentication versus authorization, where 401 errors focus on invalid or missing credentials prompting users to authenticate, while 403 errors indicate valid credentials but insufficient permissions, thus denying access regardless of authentication status. Correctly distinguishing between these codes is essential to prevent vulnerabilities and ensure secure API interactions.