> i remember you have been around since 2017 or earlier, why the wait Initially, we focused on session management only.. and we actually started working on it full time start of 2020. Then towards the end of 2020, we started on full auth.. so it's not actually been that long

i remember bedawad talking about you on yt

would you use singapore if we added it @User ? or are you talking about adding it generally? Cause so far no one has really asked for an Asian region, apart from you

> i remember bedawad talking about you on yt Yea.. that was super early.. only sessions, and a much simpler version of that. Over the months, we have worked on several aspects of security, dev experience etc..

we use alibaba cloud for our cloud service, as aws doesn't have a big asia region. our users are in hkg, china, taiwan, spore, india. latency important.

Got it. We can add singapore region in aabout a week from now.. not an issue

in AWS though

you should reach out to ben on that particialr channel ask him to review you again.

oh not becuase of me, frankly not even sure if we will use sp, but just asking..

ah ok.. then we will wait for until someone asks 🙂

great vid by the way

thanks! :))

how would you handle a stolen accessToken or even a stolen refresh token in a https cookie?

handle as in how stealing them would be possible? or how we would detect the theft?

or do you mean to ask how an attcker would use them once stolen?

1) Access to the users browser, steal the cookie 2) insert the cookie in to another browser

I'm not sure I understand your question 😅

how would SP handle a stolen token or rather i guess how does the spec (OATH) suggest how to handle this

stealing a token is easy if you have access to the users computer.

Do you mean ST instead of SP?

yes sorry

If you see the video, you can get an idea of how token theft detection works..

true i haven't watch it all the way..

yea.. I talk about it close to the end. And that's exactly what ST does

You can use browser fingerprints to detect if the tokens are stolen and afterwards revoke them ;)

@User yes that works too. But it's not as full proof since depending on the method of token theft, the attacker can also likely send of the victim's browser fingerprint to themselves, and inject that into malicious requests. The backend won't know about this and will happily accept it!

Hi Guys, I am glad that I found supertokens, I am completely confused browsing okta and auth0 docs. Here is my question: "Does supertokens have support for react native provider(google,fb,apple,twitter) SDK based login?"

some references on what i am looking for https://azure.microsoft.com/en-in/blog/logging-in-with-google-microsoft-and-facebook-sdks-to-azure-mobile-services/

Hi @User for react native, we offer session management only at the moment, but we can built out social auth (what we call thirdparty recipe). What's your timeline like?