The JAMstack - Smashing Conf Freiburg 2017

Slide 1

Slide 1 text

The JAMstack Matt Biilmann, 2017

Slide 2

Slide 2 text

Matt Biilmann CEO, Netlify

Slide 3

Slide 3 text

Publishing for the modern web

Slide 4

Slide 4 text

Building thousands of websites 7 years in Spain, 2 CMSs, 10k+ websites

Slide 5

Slide 5 text

Building a fully hosted CMS Moved to the Bay Area, built a managed CMS for the legacy stack

Slide 6

Slide 6 text

Trends: Git, MicroServices, JS Modern Javascript (ES6) Microservices Git vs FTP

Slide 7

Slide 7 text

For the last 15 years the web has been built on the fly, causing ever increasing issue with: Security 7% of all legacy sites hacked Performance Single origin, builds for every visitor, low conversion Scalability Infrastructure needs scaling up front The Web Needs a Paradigm Shift

Slide 8

Slide 8 text

Security In February, 1.5 million web pages across about 40,000 websites got defaced on a single day. In April a separate attack left 120,000 sites vulnerable. Last month, a vulnerability in a plugin left more than 300,000 legacy sites open to attacks.

Slide 9

Slide 9 text

Performance 4% of people have thrown their phone while using a slow mobile site

Slide 10

Slide 10 text

Reliability

Slide 11

Slide 11 text

The Evolution of the Web Unix Model Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1970-1997 ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT SERVER CLIENT CDN SERVICES

Slide 12

Slide 12 text

= A New Stack Decoupled Architecture Git Centric Workflow A Better Web + 10x Faster No more malware Inﬁnitely scalable Browser Client Build Tool Services Git Continuous Delivery CDN

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Wordpress Shopify Rails Kirby Magazine Shop Job Board Conference

Slide 16

Slide 16 text

Wordpress Shopify Rails Kirby Magazine Shop Job Board Conference Memberships ?????

Slide 17

Slide 17 text

Building an Open-Source Eco-System

Slide 18

Slide 18 text

Browser Front-end Hugo + Webpack GitHub Netlify CMS A Smashing Architecture Micro Services

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

Authentication Microservice

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Authenticating - Client <-> Server Unix Model Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1970-1997 ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT SERVER CLIENT CDN SERVICES Stateful Protocol

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Authenticating - Web Monolith Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT CDN SERVICES HTTP - Stateless Protocol

Slide 26

Slide 26 text

Authenticating - Web Monolith Legacy Web (The site needs to be built EVERY time it’s served) Modern Web ~1997-Today Now CLIENT WEB SERVER APP SERVER DATABASE CLIENT CDN SERVICES Browser Server user/pw Request (Cookie) DB User Lookup Create Session Session ID (Set-Cookie) Lookup Session Response (HTML)

Slide 27

Slide 27 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES ?

Slide 28

Slide 28 text

API Authentication GET /api/v1/sites HTTP/1.1 Host: api.example.com Authorization: Bearer abcd1234 SPA BROWSER CDN API How do we get an access token?

Slide 29

Slide 29 text

API Authentication SPA BROWSER CDN API OAuth2 Auth flow options: Resource Owner Password Credentials Implicit Grant Authorization Code

Slide 30

Slide 30 text

API Authentication SPA BROWSER CDN API Browser Server Request (Token) DB Lookup Session Response (JSON)

Slide 31

Slide 31 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES ?

Slide 32

Slide 32 text

Authenticating - SPA API

Slide 33

Slide 33 text

Authenticating - JAMstack API API API API API

Slide 34

Slide 34 text

Authenticating - JAMstack API API API API API

Slide 35

Slide 35 text

Authenticating - JAMstack API API Auth API API API API • Tight Coupling • Single Point of Failure • Slow Performance

Slide 36

Slide 36 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES JWT

Slide 37

Slide 37 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES https://tools.ietf.org/html/rfc7519

Slide 38

Slide 38 text

Authenticating - JWTs t Modern Web CLIENT CDN SERVICES What is a JWT? •A JWT is just string •It has 3 parts: header.payload.signature •It is signed with a secret and can be veriﬁed

Slide 39

Slide 39 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES What is a JWT? Header Payload Signature

Slide 40

Slide 40 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES

Slide 41

Slide 41 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES What is a JWT? •Token identiﬁes user (“sub” claim) •Token can authorize the user (“trust”) •Token can include display data

Slide 42

Slide 42 text

Authenticating - JAMstack API API Auth API API API API

Slide 43

Slide 43 text

API API API API API Auth API JWT JWT JWT JW T JWT JW T

Slide 44

Slide 44 text

JWT Authentication SPA BROWSER CDN API Browser API Request (JWT) Response (JSON) Verify Signature + Claims

Slide 45

Slide 45 text

Authenticating - Micro Services t Modern Web CLIENT CDN SERVICES API Gateways Kong Gotiator AWS API Gateway Netlify Microservice Gateway

Slide 46

Slide 46 text

API Authentication SPA BROWSER CDN API Browser Gateway Request (JWT) API Proxy (token) Response (JSON) Verify Signature + Claims

Slide 47

Slide 47 text

Netlify Identity

Slide 48

Slide 48 text

Content Management

Slide 49

Slide 49 text

No content

Slide 50

Slide 50 text

Decoupled E-commerce

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

Handle 200,000 comments!

Slide 53

Slide 53 text

Building an Open-Source Eco-System

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

Let’s Continue The Talk! #JAMstack jamstack.org gitter.im/jamstack/community @biilmann