joscha / play-authenticate

An authentication plugin for Play Framework 2.x (Java)
http://joscha.github.com/play-authenticate/
Other
807 stars 367 forks source link

scalability #339

Open leccyril opened 7 years ago

leccyril commented 7 years ago

Hi,

do you use play cache ? because i want to clusterize or load balance several applications with you plugin... can i make it and no take care of your plugin ? do you just use cookie ?

it is secure if i use HTTPS ?

do you test the module security ?

i don't know how to pass issue to question

thank's a lot!

oexza commented 7 years ago

@leccyril it uses play-cache but if you are going to load balance between instances then you need to externalize the cache with something like mem-cached. this plugin https://github.com/mumoshu/play2-memcached may help but i've not used it before.

On 6/16/17, leccyril notifications@github.com wrote:

Hi,

do you use play cache ? because i want to clusterize or load balance several applications with you plugin... can i make it and no take care of your plugin ? do you just use cookie ?

it is secure if i use HTTPS ?

do you test the module security ?

i don't know how to pass issue to question

thank's a lot!

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/joscha/play-authenticate/issues/339

oexza commented 7 years ago

and if you want to use redis https://github.com/KarelCemus/play-redis

On 6/16/17, Peace MICHAELS orepeace@gmail.com wrote:

@leccyril it uses play-cache but if you are going to load balance between instances then you need to externalize the cache with something like mem-cached. this plugin https://github.com/mumoshu/play2-memcached may help but i've not used it before.

On 6/16/17, leccyril notifications@github.com wrote:

Hi,

do you use play cache ? because i want to clusterize or load balance several applications with you plugin... can i make it and no take care of your plugin ? do you just use cookie ?

it is secure if i use HTTPS ?

do you test the module security ?

i don't know how to pass issue to question

thank's a lot!

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/joscha/play-authenticate/issues/339

leccyril commented 7 years ago

Thank you i use play 2.5 so play2 memcached not seems to be compatible with ths version.... playauthenticate use cache for role verification or what ? because if i stop server, restart it and not logout beforestop server if i refresh my application i not have to re-login...

thank you !

how many connection could it support if i use load balancer only if one application crash ? i read 60000 per minutes but in actual tests ?

oexza commented 7 years ago

playauthenticate use cache for role verification or what ?

During the authentication flow for social login(oauth2 providers Google, Facebook..... etc), play-authenticate stores the state token in the cache so as to validate that the auth process is not from a malicious user or something. see https://github.com/joscha/play-authenticate/blob/master/code/app/com/feth/play/module/pa/providers/oauth2/OAuth2AuthProvider.java#L220 read the code downwards. If you load balance between instances, each instance will have its own cache, which will break the auth flow. AFAIK this is the only place play-authenticate uses the cache.

how many connection could it support if i use load balancer only if one application crash ? i read 60000 per minutes but in actual tests ?

You will have to do load tests to determine this.

On 6/16/17, leccyril notifications@github.com wrote:

Thank you i use play 2.5 so play2 memcached not seems to be compatible with ths version.... playauthenticate use cache for role verification or what ? because if i stop server, restart it and not logout beforestop server if i refresh my application i not have to re-login...

thank you !

how many connection could it support if i use load balancer only if one application crash ? i read 60000 per minutes but in actual tests ?

-- You are receiving this because you commented. Reply to this email directly or view it on GitHub: https://github.com/joscha/play-authenticate/issues/339#issuecomment-309002691

leccyril commented 7 years ago

Ok for the moment i only use simple way to connect on database after signup... with this authentication i don't need to externalize cache isn't it ? i will have to do it only if i activate google connection , or facebook, or linkedin or any other using OAUTH2 ?

thank you for your great help... !!!

  1. Do you think it will be more efficient to use mongoDB instead Ebean and for example postgres ?

thanks lot !

oexza commented 7 years ago

with this authentication i don't need to externalize cache isn't it

No you don't have to.

thank you for your great help... !!!

You are welcome.

Do you think it will be more efficient to use mongoDB instead Ebean and for example postgres ?

I've not used mongo for anything serious, but i've used and still use Ebean and Postgres extensively and i say its pretty efficient, In my opinion its one of the most efficient and easy to use ORMs out there. more importantly than the ORM, database you use is how you handle blocking in your code. You want make sure that you don't block on Play's threadpool.

On 7/23/17, leccyril notifications@github.com wrote:

Ok for the moment i only use simple way to connect on database after signup... with this authentication i don't need to externalize cache isn't it ? i will have to do it only if i activate google connection , or facebook, or linkedin or any other using OAUTH2 ?

thank you for your great help... !!!

  1. Do you think it will be more efficient to use mongoDB instead Ebean and for example postgres ?

thanks lot !

-- You are receiving this because you commented. Reply to this email directly or view it on GitHub: https://github.com/joscha/play-authenticate/issues/339#issuecomment-317236777

leccyril commented 7 years ago

it seems you know playframework i have some questions how i can do to talk about with you .... and close this comment because i have response ? thank you !

oexza commented 7 years ago

Ok my email orepeace at gmail dot com.