{"componentChunkName":"component---src-templates-blog-list-template-js","path":"/51","result":{"data":{"allMarkdownRemark":{"edges":[{"node":{"excerpt":"Introduction In a modern digital world where competition is neck-and-neck, creating a frictionless consumer experience should be the top…","fields":{"slug":"/identity/loginradius-creates-trusted-digital-experience/"},"html":"

Introduction

\n

In a modern digital world where competition is neck-and-neck, creating a frictionless consumer experience should be the top priority of every business striving for success.

\n

Brands that are delivering trusted digital experiences without compromising overall security are the ones that are highly preferred by consumers worldwide.

\n

Moreover, amid the global pandemic, the way brands incorporated technology into their business and established frictionless interactions with consumers, the role of a robust consumer identity and access management (CIAM) solution can’t be overlooked.

\n

Today, enterprises must be aware that the secret to success lies in quickly identifying and eliminating any troubles and pain points that occur when consumers interact with their organization (whether through website or application).

\n

Here’s where the role of a cutting-edge CIAM solution like LoginRadius comes into play.

\n

Let’s understand how LoginRadius paves the way for brands to deliver trusted digital experiences.

\n

Security is Essential, Consumer Experience is Good - LoginRadius Gives You Both!

\n

Adding stringent layers of security seems pretty unfair in a digital world where consumers are always on a hunt for a personalized and flawless user experience.

\n

But that doesn’t mean that security can be compromised to deliver a rich user experience on a web application or a website.

\n

Statistics show that 69% of internet users are concerned about data loss/leakage and 66% are worried about their data privacy and confidentiality.

\n

On the other hand, 67% of consumers mentioned terrible experiences as a big reason for churn, but only a few complained.

\n

Many people think that adding a robust layer of security would certainly hamper consumer experience and negatively impact the overall consumer onboarding journey.

\n

So, what’s the trick that helps market leaders stay ahead of the curve? How do they secure consumer data without affecting the consumer experience?

\n

Well, the key lies in creating a perfect harmony of security and user experience through a CIAM (Consumer Identity and Access Management) solution that helps scale business growth.

\n

Yes, here’s the point where LoginRadius comes into action!

\n

With industry-standard robust security, LoginRadius ensures your consumers are always catered with a trusted digital experience whether they’re interacting with your brand for the first time or the 100th time.

\n

User Experience Backed with Security - The Key to Success in 2022 and Beyond

\n

To keep pace with the ever-growing digital world, enterprises need to create a perfect harmony of a great user experience and robust security.

\n

This can be achieved by leveraging a consumer identity and access management (CIAM) solution like LoginRadius.

\n

The cutting-edge technology coupled with excellent user experience when your consumers first interact with your brand helps build consumer trust that guarantees conversion.

\n

Whether you’re greeting your users with a personalized message or leveraging user data for product suggestions, every feature of the new-age CIAM helps your brand win consumer trust.

\n

Moreover, the best-in-class security that comes with the LoginRadius Identity Platform assures your consumers of how vigilant you are about data privacy and security.

\n

How LoginRadius Bridges the Gap Between Consumer Experience and Security?

\n

At LoginRadius, we understand the importance of delivering user experience and security to our clients to ensure their clients and potential customers enjoy a frictionless experience while navigating their platform.

\n

Here’s the list of our security features that reinforces consumer trust:

\n\n

Apart from this, the LoginRadius’ APIs use OpenID Connect (OAuth 2.0 protocol) technology—the same industry standard used by Google and LinkedIn.

\n

Our legal team ensures that the LoginRadius Identity Platform adheres to strict and updated government regulations, compliances, and policies regarding information security.

\n

Also Read: Working With Industry Authorization: A Beginner's Guide to OAuth 2.0

\n

At the same time, we also ensure delivering the finest consumer experience by:

\n\n

Is Your Digital Experience Keeping Pace With Customer Expectations?

\n

If you’re not delivering adequate security to your customers and your users face friction while exploring your online platform, you should rethink your overall digital experience.

\n

Incorporating a robust CIAM solution like LoginRadius reinforces consumer information security and helps deliver a flawless user experience each time a user interacts with your brand.

\n

Learn more about the LoginRadius Identity Platform, starting with a Quick Personalized Call with our sales team.

\n

\n \n \n

\n","frontmatter":{"date":"February 04, 2022","updated_date":null,"description":"Enterprises must be aware that the secret to success lies in quickly identifying and eliminating any troubles and pain points that occur when consumers interact with their organization. A robust CIAM like LoginRadius helps eliminate security and user experience challenges like a breeze.","title":"How LoginRadius Creates a Perfect Harmony of UX and Security","tags":["security"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.680672268907563,"src":"/static/48e81df029cf661c97f8b257dc832eca/33aa5/digital-exp.jpg","srcSet":"/static/48e81df029cf661c97f8b257dc832eca/f836f/digital-exp.jpg 200w,\n/static/48e81df029cf661c97f8b257dc832eca/2244e/digital-exp.jpg 400w,\n/static/48e81df029cf661c97f8b257dc832eca/33aa5/digital-exp.jpg 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"Authentication and authorization are critical in every software application to secure user data and allow access to trusted users. In some…","fields":{"slug":"/engineering/guest-post/loopback-rest-api-authentication/"},"html":"

Authentication and authorization are critical in every software application to secure user data and allow access to trusted users. In some cases, implementing authentication and authorization is not an easy process.

\n

However, LoopBack 4 offers an authentication package @loopback/authentication that helps secure your application's API endpoints. It provides custom authentication strategies and a @authenticate decorator that requires minimal boilerplate code.

\n

What is LoopBack?

\n

According to the LoopBack 4 documentation:

\n
\n

LoopBack is a flexible, open source Node.js and TypeScript framework built on Express. It helps you quickly develop APIs and microservices built on backend systems such as databases and SOAP or REST services.

\n
\n

Loopback provides several features that allow you to build your application with less boilerplate code.

\n

What is JSON Web Token (JWT)?

\n

JSON Web Token (JWT) is an open standard defined by Internet Engineering Task Force (IETF) in RFC 7519.

\n

It is a standard used for securely transferring claims between two parties over the internet. It uses JSON Web Signature (JWS) for the secure transfer of claims and eliminates the possibility of tampering. Accordingly, JWTs can be signed with either a secret (HMAC technique) or a public/private key pair (RSA or ECDSA).

\n

In simple words, it is used for authentication and secure information sharing. A JWT token is made up of three components that are separated by three dots:

\n\n
\n

You can learn more about JWT and its best practices here.

\n
\n

Prerequisites

\n

This tutorial is a hands-on demonstration. To follow along, be sure you have the following in place:

\n\n

Install LoopBack CLI

\n

To start building your LoopBack REST API, first install LoopBack CLI, which provides the quickest method to create a LoopBack 4 project that follows best practices.

\n

Use the command below to install the Loopback CLI globally:

\n
npm i -g @loopback/cli
\n

You can grab a cup of coffee while you wait for the installation to complete. Then open your command line, create an AuthWithLooback folder, and change the directory to the AuthWithLooback folder with commands below:

\n
mkdir AuthWithLooback\ncd AuthWithLooback
\n

Scaffold Your LoopBack Project

\n

So, you've installed Loopback CLI and created a project directory. Let's run the following command to create a LoopBack project:

\n
lb4 app
\n

Select the options as in the following screenshot to complete the prompts.

\n

\n \n \n

\n

After completing the prompts, LoopBack will configure the TypeScript compiler and install all the required dependencies. Change directory to the auth-with-loopback folder.

\n
cd auth-with-loopback
\n

Create a Model

\n

You've successfully created your Loopback application. Now, let’s create a Model to store the news details with the command below:

\n
lb4 model
\n

Select the options as in the following screenshot to complete the prompts.

\n

\n \n \n

\n

After the date_created property definition, press the enter key to exit the prompt.

\n

Loopback will create a NewsModel file in the src/models — the folder where NewsModel will be defined.

\n

Next, you need to create a data source to connect to your preferred database. For demonstration, this tutorial connects to a MongoDB database.

\n

Run the following command in your terminal to create a data source:

\n
  lb4 datasource
\n

Select the options as in the following screenshot to complete the prompts.

\n

\n \n \n

\n

After completing the prompts, LoopBack will create the News file in the src/datasource folder.

\n

Then, create a Repository for CRUD operations of your NewModel with the command below:

\n
lb4 repository
\n

After completing the prompts, LoopBack will create the NewsModelRepository file in the src/repository folder.

\n

Select NewsDatasource as the data source, NewsModel as the model for generating the repository, and DefaultCrudRepository as the base repository class.

\n

Your selection for the prompts shall look like the screenshot below.

\n

\n \n \n

\n

After completing the prompts, LoopBack will create the NewsModelRepository file in the src/repository folder.

\n

Lastly, create a controller for the NewsModel you created with the command below:

\n
  lb4 controller
\n

Your selection for the prompts should look like the screenshot below.

\n

\n \n \n

\n

After completing the prompts, LoopBack will create the NewsController file in the src/controller folder. So far, your project structure, omitting the node_modules folder, should look as follows.

\n

📦auth-with-loopback
\n┣ 📂public
\n┃ ┗ 📜index.html
\n┣ 📂src
\n┃ ┣ 📂tests
\n┃ ┃ ┣ 📂acceptance
\n┃ ┃ ┃ ┣ 📜home-page.acceptance.ts
\n┃ ┃ ┃ ┣ 📜ping.controller.acceptance.ts
\n┃ ┃ ┃ ┗ 📜test-helper.ts
\n┃ ┃ ┗ 📜README.md
\n┃ ┣ 📂controllers
\n┃ ┃ ┣ 📜README.md
\n┃ ┃ ┣ 📜index.ts
\n┃ ┃ ┣ 📜news-controller.controller.ts
\n┃ ┃ ┗ 📜ping.controller.ts
\n┃ ┣ 📂datasources
\n┃ ┃ ┣ 📜README.md
\n┃ ┃ ┣ 📜index.ts
\n┃ ┃ ┗ 📜news.datasource.ts
\n┃ ┣ 📂models
\n┃ ┃ ┣ 📜README.md
\n┃ ┃ ┣ 📜index.ts
\n┃ ┃ ┗ 📜news-model.model.ts
\n┃ ┣ 📂repositories
\n┃ ┃ ┣ 📜README.md
\n┃ ┃ ┣ 📜index.ts
\n┃ ┃ ┗ 📜news-model.repository.ts
\n┃ ┣ 📜application.ts
\n┃ ┣ 📜index.ts
\n┃ ┣ 📜migrate.ts
\n┃ ┣ 📜openapi-spec.ts
\n┃ ┗ 📜sequence.ts
\n┣ 📜.dockerignore
\n┣ 📜.eslintignore
\n┣ 📜.eslintrc.js
\n┣ 📜.gitignore
\n┣ 📜.mocharc.json
\n┣ 📜.prettierignore
\n┣ 📜.prettierrc
\n┣ 📜.yo-rc.json
\n┣ 📜DEVELOPING.md
\n┣ 📜Dockerfile
\n┣ 📜README.md
\n┣ 📜package-lock.json
\n┣ 📜package.json
\n┗ 📜tsconfig.json

\n

Add Custom Data

\n

Now that you have the Model setup, run the server, and add some custom data to the News collection in MongoDB.

\n
    #start the server\n    npm run start
\n

The above command will start the TypeScript compiler, which will build the project and check for possible errors. If everything goes well with the code, you should see the output on the terminal, as follows:

\n

\n \n \n

\n

Next, open your favorite browser and navigate to http://localhost:3000. You should see an output as follows:

\n

\n \n \n

\n

Now, click on the explorer link, where you can make requests to your LoopBack application. On the explorer page, locate the post endpoint and add some custom data to the news collection by clicking the try it out button with the data below on the request body.

\n
{\n  "title": "Upgrade to Loopback V4",\n  "body": "The developers of Loopback urges the V3 users to upgrade to V4 as soon as possible",\n  "date_created": "2021-12-14T00:57:43.197Z"\n}
\n

Then, click the execute button to run the query.

\n

\n \n \n

\n

You can add as many records as you like to experiment with the endpoints. The important thing to note here is that the endpoints are not protected. Anyone may create, read, update, and delete records.

\n

In a moment, this tutorial explains how to secure the endpoints so that only logged-in users can access them.

\n

To begin, install LoopBack authentication and authentication-jwt, as follows:

\n
  npm i --save @loopback/authentication @loopback/authentication-jwt
\n

Setup Authentication Components

\n

To protect the application, you'll implement user authentication and authorization, which implies that only logged-in users will be able to access your APIs. You'll create two endpoints in the User controller:

\n\n

Create Your Signup Endpoint

\n

You’ll start with the signup controller to enable users to create an account. Create an empty controller with the command below:

\n
    lb4 controller
\n

Your selection for the prompts should be as follows:

\n

\n \n \n

\n

Then, open the src/controllers/user.controller.ts file, and import the required modules with the following code snippet:

\n
    import { authenticate, TokenService } from '@loopback/authentication';\n    import {\n      Credentials,\n      MyUserService,\n      TokenServiceBindings,\n      User,\n      UserRepository,\n      UserServiceBindings,\n    } from '@loopback/authentication-jwt';\n    import { inject } from '@loopback/core';\n    import { model, property, repository } from '@loopback/repository';\n    import {\n      get,\n      getModelSchemaRef,\n      post,\n      requestBody,\n      SchemaObject,\n    } from '@loopback/rest';\n    import { SecurityBindings, securityId, UserProfile } from '@loopback/security';\n    import { genSalt, hash } from 'bcryptjs';\n    import _ from 'lodash';\n    ........
\n

Next, set up your user credential objects, and verify the user credentials using the UserService, injecting MyUserService into the authentication-jwt extension.

\n
    @model()\n    export class CreateUser extends User {\n      @property({\n        type: 'string',\n        required: true,\n      })\n      password: string;\n    }\n\n    const UserSchema: SchemaObject = {\n      type: 'object',\n      required: ['email', 'password'],\n      properties: {\n        email: {\n          type: 'string',\n          format: 'email',\n        },\n        password: {\n          type: 'string',\n          minLength: 6,\n        },\n      },\n    };\n\n    export const RequestBody = {\n      description: 'The input of login function',\n      required: true,\n      content: {\n        'application/json': { schema: UserSchema },\n      },\n    };\n\n    export class UserController {\n      constructor(\n        @inject(TokenServiceBindings.TOKEN_SERVICE)\n        public jwtService: TokenService,\n        @inject(UserServiceBindings.USER_SERVICE)\n        public userService: MyUserService,\n        @inject(SecurityBindings.USER, { optional: true })\n        public user: UserProfile,\n        @repository(UserRepository) protected userRepository: UserRepository,\n      ) { }\n    ..........
\n

Finally, you'll build your signup endpoint, which will listen to POST requests. Here, you shall save the hashed version of the user's password in the database to keep it safe.

\n
     @post('/signup', {\n      responses: {\n        '200': {\n          description: 'User',\n          content: {\n            'application/json': {\n              schema: {\n                'x-ts-type': User,\n              },\n            },\n          },\n        },\n      },\n    })\n    async signUp(\n      @requestBody({\n        content: {\n          'application/json': {\n            schema: getModelSchemaRef(CreateUser, {\n              title: 'NewUser',\n            }),\n          },\n        },\n      })\n      newUserRequest: CreateUser,\n    ): Promise<User> {\n      const password = await hash(newUserRequest.password, await genSalt());\n      const savedUser = await this.userRepository.create(\n        _.omit(newUserRequest, 'password'),\n      );\n\n      await this.userRepository.userCredentials(savedUser.id).create({ password });\n\n      return savedUser;\n    }\n    .........
\n

Create Your Login Controller

\n

Now that you've set up the signup endpoint, create the login endpoint so that registered users may log in to the API.

\n

Using the code snippet below, set up the login route in the src/controllers/user.controller.ts file. In the event of a successful log-in, a token is sent to the user.

\n
      @post('/signin', {\n      responses: {\n        '200': {\n          description: 'Token',\n          content: {\n            'application/json': {\n              schema: {\n                type: 'object',\n                properties: {\n                  token: {\n                    type: 'string',\n                  },\n                },\n              },\n            },\n          },\n        },\n      },\n    })\n    async signIn(\n      @requestBody(RequestBody) credentials: Credentials,\n    ): Promise<{ token: string }> {\n      const user = await this.userService.verifyCredentials(credentials);\n      const userProfile = this.userService.convertToUserProfile(user);\n      const token = await this.jwtService.generateToken(userProfile);\n      return { token };\n    }
\n

Perhaps, you can show the currently logged-in user by adding a /whoami endpoint.

\n

In the src/controllers/user.controller.ts file, get the details of the currently logged-in user using the code snippet below. Users should access this endpoint only when they are logged in.

\n
      @authenticate('jwt')\n      @get('/whoami', {\n        responses: {\n          '200': {\n            description: 'Return current user',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'string',\n                },\n              },\n            },\n          },\n        },\n      })\n      async whoAmI(\n        @inject(SecurityBindings.USER)\n        loggedInUserProfile: UserProfile,\n      ): Promise<string> {\n        return loggedInUserProfile[securityId];\n      }
\n

Now, open src/application.ts and bind the authentication components to your application class. First, import Loopback AuthenticationComponent, JWTAuthenticationComponent, and NewsDataSource from your datasources using the following code snippet:

\n
//...\nimport { AuthenticationComponent } from "@loopback/authentication"\nimport {\n  JWTAuthenticationComponent,\n  UserServiceBindings,\n} from "@loopback/authentication-jwt"\nimport { NewsDataSource } from "./datasources"\n//...
\n

Then, mount the jwt authentication system and bind your NewsDataSource to the UserService data source.

\n
//...\n// ------ ADD SNIPPET INSIDE THE CONTRUCTOR BLOCK ---------\nthis.component(AuthenticationComponent)\nthis.component(JWTAuthenticationComponent)\nthis.dataSource(NewsDataSource, UserServiceBindings.DATASOURCE_NAME)\n//...
\n

Finally, add the authenticate action in the Sequence. Also, modify the error when authentication fails to return status code 401 (Unauthorized). Open the src/sequence.ts file and add the code snippet below:

\n
    import { FindRoute, InvokeMethod, MiddlewareSequence, ParseParams, Reject, RequestContext, Send, SequenceActions, SequenceHandler } from '@loopback/rest';\n    import {\n        AuthenticateFn,\n        AuthenticationBindings,\n        AUTHENTICATION_STRATEGY_NOT_FOUND,\n        USER_PROFILE_NOT_FOUND,\n    } from '@loopback/authentication';\n    import { inject } from "@loopback/core"\n    export class MySequence implements SequenceHandler {\n        constructor(\n            @inject(SequenceActions.FIND_ROUTE) protected findRoute: FindRoute,\n            @inject(SequenceActions.PARSE_PARAMS)\n            protected parseParams: ParseParams,\n            @inject(SequenceActions.INVOKE_METHOD) protected invoke: InvokeMethod,\n            @inject(SequenceActions.SEND) protected send: Send,\n            @inject(SequenceActions.REJECT) protected reject: Reject,\n            @inject(AuthenticationBindings.AUTH_ACTION)\n            protected authenticateRequest: AuthenticateFn,\n        ) { }\n        async handle(context: RequestContext) {\n            try {\n                const { request, response } = context;\n                const route = this.findRoute(request);\n                //call authentication action\n                await this.authenticateRequest(request);\n                // Authentication successful, proceed to invoke controller\n                const args = await this.parseParams(request, route);\n                const result = await this.invoke(route, args);\n                this.send(response, result);\n            } catch (error) {\n                if (\n                    error.code === AUTHENTICATION_STRATEGY_NOT_FOUND ||\n                    error.code === USER_PROFILE_NOT_FOUND\n                ) {\n                    Object.assign(error, { statusCode: 401/* Unauthorized */ });\n                }\n                this.reject(context, error);\n                return;\n            }\n        }\n    }
\n

Protect News Endpoints

\n

So far, you've implemented user authentication for your API. Now, protect your News endpoints so that only authenticated users can access those routes.

\n

Open the src/controllers/news.controller.ts file, and import authenticate from jwt authentication.

\n
import { authenticate } from "@loopback/authentication"
\n

Then on each of the endpoints in your news controller, add @authenticate('jwt') before the NewsController class, which will protect all the routes in NewsController.

\n
    //...\n    @authenticate('jwt')\n    //...
\n

Perhaps, you may not want to protect all the routes, simply add the @authenticate('jwt') method before the route you wish to protect. You can protect the POST route as follows:

\n
    @authenticate('jwt')\n    @post('/news-models')\n      @response(200, {\n        description: 'NewsModel model instance',\n        content: { 'application/json': { schema: getModelSchemaRef(NewsModel) } },\n      })\n      async create(\n        @requestBody({\n          content: {\n            'application/json': {\n              schema: getModelSchemaRef(NewsModel, {\n                title: 'NewNewsModel',\n                exclude: ['id'],\n              }),\n            },\n          },\n        })\n        newsModel: Omit<NewsModel, 'id'>,\n      ): Promise<NewsModel> {\n        return this.newsModelRepository.create(newsModel);\n      }
\n

Test Your Application

\n

You've implemented user authentication in your REST API and secured the routes against unauthorized users. Let's put your application to the test. Press CTRL-C to exit the server and restart it with the following command:

\n
    npm start
\n

If you open the explorer page, you should see the UserController endpoints.

\n

\n \n \n

\n

If you try to execute any query on NewsController, you get a 404 (Unauthorized) error. So, sign up by clicking the /signup endpoint — and log in from the /users/login endpoint. On successful login, copy the token, scroll to the top, click on the Authorize button, and paste the token.

\n

\n Introduction\n

Onboarding is a term used to describe the process of making new users familiar with the features and benefits of an application or website. Onboarding can be designed in many different ways, depending on what a company wants to achieve.

\n

This article will explore how a good onboarding process can improve your user retention and conversion rates and it will also brief you about the different kinds of onboarding and issues related to it.

\n

What is Onboarding?

\n

User onboarding is a set of instructions or interactions that aid the user in welcoming into the application. These interactions can be as simple as a greeting or as complicated as a series of guided tasks that assist users in putting up initial preferences or pointing out critical UI elements. The goal remains to provide users with an overview of your product's benefits, which will get them happy and set them up for success.

\n

If you’ve ever tried a new app for the first time and were presented with 2-3 screens with short messages explaining what the app is for, it's normal for everyone to have an expectation before using the application. This is the key to generating a positive user experience.

\n

Types of Onboarding

\n

Benefits-oriented onboarding

\n

This kind of onboarding is meant to encourage conversion by displaying the app's value to the user. It focuses on what the app is rather than how to work the app. This type of onboarding frequently allows screens dedicated to permission requests, such as access to locations and managing push notifications.

\n

Function-oriented onboarding

\n

This approach focuses on increasing app functionality by showing the user how to operate the app. The user will receive a tour of the app, as well as specific instructions on how to start and how to perform certain tasks.

\n

Progressive onboarding

\n

Progressive onboarding provides fresh information to users as they gradually glide through the app. The instructions displayed on the screen correlate to a unique page that the user is on, allowing them to understand each function as they go deeper into the app.

\n

How Onboarding Leads to Better User Experience for Customers

\n

The startling reality is that 25% of users quit using an app after only a few minutes of use. Users dump an app if it is too long to guess. They must first discover the urgent value in it, feel secure in using the product and have confidence that it will help them attain a specific goal. As a result, it is important to give a positive first impression.

\n

How do you do it? Let’s find out!

\n

Seamless registration and authentication

\n

When a customer signs up for the first time, they go through the process of onboarding, which helps them get started with your product. Customer onboarding is critical because it sets the tone for the relationship and creates a positive experience that can impact future success.

\n

Creating an account to do business with you will always be a hurdle for a customer - no matter how important that business may be. Seamless registration and authentication can help simplify the process so customers can do their business more easily and with more confidence.

\n

Finding immediate value

\n

The success of popular mobile apps boils down to one thing: they benefit users. The process of creating an amazing customer experience involves having a profound understanding of the target users' lives and unmet needs. Users must first view the current value of an app before downloading it.

\n

How will this app aid them in fulfilling their needs? You can easily demonstrate what the app does and what the user stands to gain by applying the benefits-oriented onboarding method. If users understand the value in the product they are using, they will more likely experience using it in the long run.

\n

Personalization

\n

In many ways, onboarding can provide the personalization every user is searching for. Progressive onboarding ensures you don't overwhelm the user with too many functions they aren't prepared to work with. Instead, as they gradually glide through the app, they require new information, so their experience isn’t monotonous. The instructions correspond to the unique page the user is on, allowing the user to learn as they get deeper into the app. As a result, the user can only grab what they need out of the app.

\n

\n \n

The end goal remains to provision your users with a positive experience from the beginning of the app to the end of the game when they achieve their main goal. Onboarding is just one cog in the wheel that can help you get a more positive experience. While the goal remains to make certain the user is satisfied with the product, your business also benefits from providing a positive experience.

\n

\n \n \n

\n","frontmatter":{"date":"February 02, 2022","updated_date":null,"description":"The key to a seamless onboarding experience is to make the process as simple and safe as possible – from the first moment a new customer accesses your site until the moment they are authenticated and logged in. This article explains how.","title":"How to Make a Strong Impression With Your Onboarding Process?","tags":["user onboarding","progressive profiling","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.9607843137254901,"src":"/static/1c051b6f381dee9312b8c6f68b0cbdc5/33aa5/onboarding.jpg","srcSet":"/static/1c051b6f381dee9312b8c6f68b0cbdc5/f836f/onboarding.jpg 200w,\n/static/1c051b6f381dee9312b8c6f68b0cbdc5/2244e/onboarding.jpg 400w,\n/static/1c051b6f381dee9312b8c6f68b0cbdc5/33aa5/onboarding.jpg 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Navanita Devi","github":null,"avatar":null}}}},{"node":{"excerpt":"Introduction The past two years were full of uncertainties amid the global pandemic and have been highly disruptive in terms of economy…","fields":{"slug":"/identity/smart-citiy-cybersecurity-trends-2022/"},"html":"

Introduction

\n

The past two years were full of uncertainties amid the global pandemic and have been highly disruptive in terms of economy, human lives, and rising cybersecurity threats.

\n

Yes, for a couple of years, the way we use technology has taken a paradigm shift since the remote working ecosystem, and remote access became the new normal.

\n

Talking about the cybersecurity threats, the attackers explored new ways to exploit organizations by targeting their employees and users by surpassing frail security mechanisms in the past few years.

\n

However, the new year’s projections can’t be the same, just as similar to the previous year; the challenges in the upcoming years could be even worse.

\n

As the idea of smart cities comes into existence and more and more cities jump on the technology bandwagon to enhance experiences, the risks from security threats increase.

\n

Here’s a list of potential security trends that every individual, business, or organization must keep in mind and ensure they remain safe by adopting appropriate security measures.

\n

1. Supply chain cyber attacks will continue to surge

\n

We’ve witnessed a substantial increase in the number of cyberattacks that mainly targeted software supply chains. These kinds of attacks are proven to be highly destructive since they can quickly take down an organization’s overall software supply chain coupled with services.

\n

Unfortunately, in the New Year 2022, these kinds of supply chain attacks will become even more common since attackers are now considering these attacks as an effective mode of mass disruption within an organization.

\n

2. Smart devices and nagging risks

\n

The idea of smart cities is incomplete without the intervention of IoT devices that create an interconnected network of smart devices.

\n

However, the Internet of Things is inevitably a swiftly growing trend associated with many cybersecurity threats.

\n

In the past year, several instances of data breaches through IoT networks have been reported in the past year. The incidents mostly took place because of the inadequate machine-to-machine access control.

\n

Hackers can quickly attack through several vulnerable devices, including security cameras, smart DVRs, or smart home assistants.

\n

The same or even worse is expected in the year 2022 and beyond.

\n

Also Download: Smart and IoT Authentication

\n

3. The rise of tractor hackers

\n

The advancement of technology has undoubtedly offered endless possibilities and has exposed every industry to significant cyber threats.

\n

Farming is also one of the most vulnerable industries facing numerous challenges for the past couple of years, and in 2022, it will surely be under the spotlight for cyberattackers.

\n

Many modern tractors now run software just like cars and are more susceptible to attacks that can cause financial losses.

\n

Also, remote farming and automation in this industry have posed severe challenges and threats, including disruption of food supply chains.

\n

#4. Shareware attack

\n

Shareware is commercial software that is distributed to consumers for free. It is usually handed out as complimentary software to encourage users to pay for the parent software. Mostly, shareware is safe, but it can be risky at times.

\n

Many organizations have fallen prey to these kinds of shareware attacks in the past couple of years, and the numbers are increasing swiftly.

\n

In 2022, cybercriminals may use it to distribute malware that could lead to malicious attacks. Organizations may put themselves at risk of unwanted exposure.

\n

5. Ransomware will continue to exploit organizations and individuals

\n

When it comes to cybersecurity threats, ransomware attacks are undeniably at the forefront of cybercriminals since they provide hefty monetary benefits.

\n

Last year, ransomware was the most significant concern among cybersecurity leaders to protect their organizations, employees, and clients.

\n

With the frequency of ransomware attacks increasing swiftly, cybersecurity leaders predict that organizations need to gear up since these kinds of threats quickly would surely rise.

\n

The Bottom Line

\n

There has been a substantial increase in the number of cybersecurity threats in the past couple of years, especially after the global pandemic outbreak in 2019.

\n

Though it’s challenging to deal with any cybersecurity threat, cybersecurity experts always advise every organization, individual, and private sector organization to strengthen their first line of defense for maximum safety.

\n

The threats mentioned above would continue to rise in the new year. Everyone must put their best foot forward well in advance to avoid tarnishing their market image and mitigate the risk of hefty financial losses.

\n

\n \n \n

\n","frontmatter":{"date":"February 02, 2022","updated_date":null,"description":"Attackers explore new ways to exploit organizations by targeting their employees and users by surpassing frail security mechanisms in the past few years. Here’s a list of potential security trends that every individual, business, or organization must keep in mind and ensure they remain safe by adopting appropriate security measures.","title":"Smart Cities and Cyber Security Trends to Watch Out in 2022","tags":["security"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":2.127659574468085,"src":"/static/550735f1581f1cf725c74bc7cea1ddf1/33aa5/smart-cities.jpg","srcSet":"/static/550735f1581f1cf725c74bc7cea1ddf1/f836f/smart-cities.jpg 200w,\n/static/550735f1581f1cf725c74bc7cea1ddf1/2244e/smart-cities.jpg 400w,\n/static/550735f1581f1cf725c74bc7cea1ddf1/33aa5/smart-cities.jpg 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"Authentication remains at the core of any application with user data and accounts. It ensures that only the authorized person is accessing…","fields":{"slug":"/engineering/developers-can-get-rid-of-password-based-authentication/"},"html":"

Authentication remains at the core of any application with user data and accounts. It ensures that only the authorized person is accessing the data and account. So far, Password-based authentication has been prevalent that developers mostly use.

\n

Unfortunately, passwords are no longer a wise choice for developers to ensure secure and seamless authentication. Let’s see why:

\n\n

Before talking about the solution in detail, let’s get deeper into the problem and see what are the common cyber-attacks faced by password-based authentication.

\n

Common Cyber-attacks with Password-based Authentication

\n

The following is the list of common password attacks. It also explains what additional efforts developers need to put in to fight these cyber-attacks and protect user data:

\n\n

To protect against this attack, developers have to develop security features like suspending or locking user accounts on multiple subsequent attempts to log in with an incorrect password.

\n\n

To protect against this attack, developers have to ensure that users are not using insecure or previously breached passwords.

\n\n

To protect against this attack, developers need to introduce 2FA (two-factor authentication). Stakes are high in this case as a lot depends on how users take security measures.

\n\n

That is where developers have to be cautious, keeping all the data-in-transit encrypted.

\n

Luckily getting rid of passwords from the authentication mechanism can address all the above-stated problems. Eliminating passwords from internet space is certainly not a 1-day thing, but the responsibility lies with developers.

\n

Developers should introduce more secure and user-friendly authentication methods to their application users such as magic links, single sign-on (SSO), biometric, hardware-based authentication.

\n

Alternatives to Password-based Authentication

\n

Passwordless Authentication

\n

It does the user authentication based on the \"possession factor.\" That is where developers find passwordless authentication trustworthy, as the authentication uses a phone number, email ID, or authenticator app to cater to an OTP, one-time link, or code respectively to verify the user.

\n

Through this, developers can improve the user experience of the application and reduce risk while minimizing the total cost of storing the login credentials. Users will employ the one-time link or OTP only if they are logged into their email or possess the phone for SMS. This assures the developer a better security.

\n

Single Sign-on

\n

Almost all websites demand some form of authentication to access their content and features. Single sign-on authentication has become a standard authentication method for website logins.

\n

Developers can integrate the single sign-on feature in their web applications to facilitate users to securely authenticate multiple apps and websites by leveraging one set of login credentials.

\n

Through SSO, developers can implement multi-factor authentication implicitly. It uses a federated identity management architecture that relies on open standard protocols to exchange identity and authentication information among these protocols. That makes implementing the security easier for developers.

\n

Biometric Authentication

\n

Biometrics refers to the user's physical characteristics allowing them to identify uniquely on a digital platform. Instead of typing letters, numbers, and symbols (for passwords), biometric authentication uses biometric systems to calculate and estimate the user's physical attributes. Facial recognition, tiny impressions made by fingerprints, and vocal cadence are well-known biometric authentication techniques.

\n

It is gaining traction because developers do not have to maintain a separate database of usernames and passwords since the authentication takes place from the user device rather than the application's database.

\n

Smart Authentication

\n

Most in-house developers and smart device vendors leverage this authentication technique to avoid password authentication. This authentication mostly uses QR codes or link-based login approaches. Here the one-time link or the QR code uniquely generates the verification process that helps initiate the user login process without any password.

\n

Hardware-based authentication

\n

In this approach, the authentication uses a dedicated plug-and-run physical device belonging to the authorized user. These versatile security devices help users log in to desktops, Wi-Fi, websites, and other applications.

\n

FIDO2 devices are touch-sensed USB sticks that enable hardware authentication and follow the FIDO Alliance standards and specifications. Leveraging this authentication mechanism is a plus point as the developers do not have to maintain a secure database for the login credentials.

\n

Can we actually get rid of passwords?

\n

For decades, password-based authentication has been the mainstay for security and user verification. On average, almost all online users have 20 to 30 login credentials for different applications and sites. Password logins have become so common that changing the authentication trend and adopting a new authentication approach will take time.

\n

All the alternatives mentioned in this article can help minimize using passwords to a significant level. It's time developers should seriously ponder the problems that passwords can create for themselves and opt for reasonable alternatives as per the situation, requirements, or policy standards.

\n

Conclusion

\n

Passwords are becoming more like a liability rather than a security asset. Hence, to get rid of them, developers are leveraging other means of authentication that are more reliable and less susceptible to security breaches and threats.

\n

Worried about efforts involved in implementing these alternative authentication methods from scratch? LoginRadius identity platform comes with these authentication techniques so that developers do not have to implement them from scratch in their applications to provide alternate authentication.

\n","frontmatter":{"date":"January 31, 2022","updated_date":null,"description":"Authentication remains at the core of any application with user data and accounts. It ensures that only the authorized person is accessing the data and account. So far, Password-based authentication has been prevalent that developers mostly use.","title":"When Can Developers Get Rid of Password-based Authentication?","tags":["Authentication"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/ec99b982c7381590d9835756acbaf197/ee604/password-dev.png","srcSet":"/static/ec99b982c7381590d9835756acbaf197/69585/password-dev.png 200w,\n/static/ec99b982c7381590d9835756acbaf197/497c6/password-dev.png 400w,\n/static/ec99b982c7381590d9835756acbaf197/ee604/password-dev.png 800w,\n/static/ec99b982c7381590d9835756acbaf197/f3583/password-dev.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Kundan Singh","github":null,"avatar":null}}}},{"node":{"excerpt":"BigCommerce is a great eCommerce platform with rich features, and millions of people benefit from it. But there are limitations when you…","fields":{"slug":"/engineering/extend-ciam-capabilities-of-bigcommerce/"},"html":"

BigCommerce is a great eCommerce platform with rich features, and millions of people benefit from it. But there are limitations when you want to extend the platform for the following identity and access management requirements:

\n\n

Let’s talk about how you can extend BigCommerce and add on the above-mentioned features hassle-free.

\n

The answer is to utilize a CIAM (Consumer Identity and Access Management) that provides BigCommerce integration. You can easily configure and implement these features with minimal development effort using the CIAM provider. One such CIAM provider is LoginRadius.

\n

How to Implement These Features

\n

You are required to create an account with the CIAM provider, enable BigCommerce Integration, and do needed configurations in both BigCommerce and CIAM Provider. For more details, refer to this guide here.\nThis guide also explains the modifications required in your Stencil or Blueprint themes of BigCommerce. As a result of this implementation, you can enable the desired authentication method(s) for customers of your BigCommerce Application. Consequently, making the eCommerce experience smoother for your customers.

\n

Both customer and business will see several benefits (described below) from using CIAM solutions for features such as SSO, Phone Login, Prefilled Customer Information, and Analytics.

\n

Benefits of Implementing These Features

\n

Enhanced Customer Experience with SSO

\n

SSO lets customers log in with an existing identity. Allowing customers to use their existing identity increases conversions and return rates. It also improves security by allowing your customers to manage lesser digital identities and credentials.\nThe movement toward Bring Your Own Identity(BYOI) is gaining prominence as customers look to control their digital profiles, and SSO enables customers to bring their own digital identity.

\n

Increased Customer Engagement with Phone Login

\n

Phone login via OTP allows customers to easily log into their account without remembering a username or password. They only need to provide the Phone Number and then enter the received OTP to log in.

\n

This process makes sign-up and sign-in seamless for the customers and improves customer engagement. Also, businesses get fewer or no forgot password requests from customers, which reduces the support efforts.

\n

Improved Upsell and Cross-sell with Prefilled Information

\n

The top reason behind the cart abandonment is the long or confusing checkout process. Using the prefilled customer information with the LoginRadius Social Login feature, you can reduce the overall time involved in the checkout process.

\n

Prefilled customer information such as name, city, email address during checkout allows customers to place orders quickly.

\n

Let’s say a customer logged in using a social account and during checkout. With the customer’s permission, LoginRadius can retrieve basic information like name, email, birth date, gender from their social account. Thus, the customers need not enter data manually and experience a shorter and smoother checkout process.

\n

Insights Turned into Actions

\n

When you use LoginRadius as CIAM, it stores your customer data with your desired data centers. Also, LoginRadius Dashboard allows you to access the customer analytics related to identity, demographics, login, communication, etc. These analytics and charts help you understand your customers and their preferences better.

\n

For example:

\n\n

In addition to the benefits mentioned above, you experience below additional benefits:

\n\n

Conclusion

\n

Extending the capabilities of your great eCommerce platform is like a cherry on the cake. Signup for free and get in touch with us to take your eCommerce platform a level ahead.

\n","frontmatter":{"date":"January 27, 2022","updated_date":null,"description":"Want to add Phone Login or Single Sign-on for customers of your BigCommerce application? This article explains it all. Towards the end, it talks about how LoginRadius can help you improve upsell and cross-sell.","title":"4 Ways to Extend CIAM Capabilities of BigCommerce","tags":["BigCommerce","Authentication","CIAM"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/d145b262e248d51a28c0d8d8d731e1f2/ee604/4-ways-to-extend-ciam-capabilities.png","srcSet":"/static/d145b262e248d51a28c0d8d8d731e1f2/69585/4-ways-to-extend-ciam-capabilities.png 200w,\n/static/d145b262e248d51a28c0d8d8d731e1f2/497c6/4-ways-to-extend-ciam-capabilities.png 400w,\n/static/d145b262e248d51a28c0d8d8d731e1f2/ee604/4-ways-to-extend-ciam-capabilities.png 800w,\n/static/d145b262e248d51a28c0d8d8d731e1f2/f3583/4-ways-to-extend-ciam-capabilities.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Archna Yadav","github":null,"avatar":null}}}}]},"markdownRemark":{"excerpt":"Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards…","fields":{"slug":"/identity/developer-first-identity-provider-loginradius/"},"html":"

Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards and refining approaches to building secure, seamless experiences.

\n

We’re here to support developers on that journey. We know how important simplicity, efficiency, and well-structured documentation are when working with identity and access management solutions. That’s why we’ve redesigned the LoginRadius website—to be faster, more intuitive, and developer-first in every way.

\n

The goal? Having them spend less time searching and more time building.

\n

What’s New and Improved on the LoginRadius Website?

\n

LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve spent the last few months redesigning our interface— making navigation more intuitive and reassuring that essential resources are easily accessible.

\n

Here’s a closer look at what’s new and why it’s important:

\n

A Developer-Friendly Dark Theme

\n

\"This

\n

Developers spend long hours working in dark-themed IDEs and terminals, so we’ve designed the LoginRadius experience to be developer-friendly and align with that preference.

\n

The new dark mode reduces eye strain, enhances readability, and provides a seamless transition between a coding environment and our platform. Our new design features a clean, modern aesthetic with a consistent color scheme and Barlow typography, ensuring better readability. High-quality graphics and icons are thoughtfully placed to enhance the content without adding visual clutter.

\n

So, whether you’re navigating our API docs or configuring authentication into your system, our improved interface will make those extended development hours more comfortable and efficient.

\n

Clear Categorization for LoginRadius Capabilities

\n

\"This

\n

We’ve restructured our website to provide a straightforward breakdown of our customer identity and access management platform capabilities, helping you quickly find what you need:

\n\n

This structured layout ensures you can quickly understand each capability and how it integrates into your identity ecosystem.

\n

Developer-First Navigation

\n

\"This

\n

We’ve been analyzing developer workflows to identify how you access key resources. That’s why we redesigned our navigation with one goal in mind: to reduce clicks and make essential resources readily available.

\n

The new LoginRadius structure puts APIs, SDKs, and integration guides right at the menu bar under the Developers dropdown so you can get started faster. Our Products, Solutions, and Customer Services are also clearly categorized, helping development teams quickly find the right tools and make informed decisions.

\n

Quick Understanding of Integration Benefits

\n

\"This

\n

Developers now have a clear view of the tech stack available with LoginRadius, designed to support diverse business needs.

\n

Our platform offers pre-built SDKs for Node.js, Python, Java, and more, making CIAM integration seamless across popular programming languages and frameworks.

\n

Over to You Now!

\n

Check out our revamped LoginRadius website and see how the improved experience makes it easier to build, scale, and secure your applications.

\n

Do not forget to explore the improved navigation and API documentation, and get started with our free trial today. We’re excited to see what you’ll build with LoginRadius!

\n","frontmatter":{"date":"February 21, 2025","updated_date":null,"description":"LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve redesigned our website interface, making navigation more intuitive and reassuring that essential resources are easily accessible.","title":"Revamped & Ready: Introducing the New Developer-First LoginRadius Website","tags":["Developer tools","API","Identity Management","User Authentication"],"pinned":true,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7857142857142858,"src":"/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp","srcSet":"/static/80b4e4fbe176a10a327d273504607f32/61e93/hero-section.webp 200w,\n/static/80b4e4fbe176a10a327d273504607f32/1f5c5/hero-section.webp 400w,\n/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp 800w,\n/static/80b4e4fbe176a10a327d273504607f32/99238/hero-section.webp 1200w,\n/static/80b4e4fbe176a10a327d273504607f32/7c22d/hero-section.webp 1600w,\n/static/80b4e4fbe176a10a327d273504607f32/1258b/hero-section.webp 2732w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},"pageContext":{"limit":6,"skip":300,"currentPage":51,"type":"///","numPages":161,"pinned":"ee8a4479-3471-53b1-bf62-d0d8dc3faaeb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}