Gone are the days when learning coding or programming was reserved for the geeks or nerds. The case is exactly different nowadays. The latest buzz of “How to code” is here to stay. Making sure that you have little coding knowledge under your belt is proving to be an incredible skill no matter whether you are a marketer or an entrepreneur or a member of any of business team. Talk to any entrepreneur, marketer or freelancer, you will get an idea about learning coding will help you get through. The reasons are more than one! Half of the 2016 is gone, so if you haven’t included this incredible skill in your 2017’s new year resolution, you need to reconsider. Here is why!
\nWith softwares ruling the digital world, the demand of learning coding is becoming must for every professionals in every field whether it is marketing, technology, commerce, finance and what not. As the digital age is making us more and more dependant on computer softwares for business, learning to code has become helpful here. Learn to code is already in the must have technical skills list of 21st century and this demand of technical skills is growing like never before.
\nCoding is problem solving. Coding is no different than the way you can fuel up your car, check the oil and get it serviced by reading the manual you are provided with. But coding takes you a long way ahead. It is beyond these simple things. It teaches you to repaint your car, customize the engine to make it work in the way you want. Hope you got an idea why coding is important and why you should also learn it.
\nYeah, yeah, I know this coding thing is not the only factor behind their success (or should I say making them billionaire), but it didn’t hurt either.
\nBut unlike them, most of us were not gifted with this kind of exposure to the digital world and most of us are still naive to how the world of programming works. Many of the people around are still wondering how to write and combine the long string of code to create a beautiful website, app and more! And trust me you are not alone!
\nBut don’t worry because with so many information available online, you can also master the same. No need to spend a lot of money or put yourself in debt in coding learning, as these resources are definitely going to help you to get through this.
\nPrice - Free but pro-version also available at $19.99/moPro for $19.99/moPro for $19.99/mo
\nCodecademy - Teaching the world how to code, definitely tops my list while talking about the top resources for how to learn programming. Currently owning around 25 million users, one can start learning as soon as he registers himself on the website. They can learn to design websites with HTML, CSS and also customize it with Javascript.
\nThe courses provided are not lecture style but the students actually get to do hands on coding and witness changes real time. Sims, the owner of Codecademy says that the website allows students to learn the coding by providing preview for every line they write immediately instead of watching an instructor. Apart from that, Codecademy also provides students access to QnA forums and groups to learn on topics like Python, Ruby on Rails, Etsy, etc.
\n2. W3schools :
\nPrice : Free
\nW3schools - the largest web developer site, as they define it, provides free tutorials on JavaScript, HTML, CSS, jQuery and what not along with lot of references. So if you want to know what
The website provides tiered subscription plan that allows users to download multiple ebooks too along with the course. The ebook comprises of a huge catalog that comes with different code specifics like Jekyll, Sass, SVG, etc. I should definitely not forget to mention that even professionals can take the ongoing education courses to brush up their programming skills. The website provides learner tutorials in the form of write-ups about various topics.
\nPrice : Free but pro version available at $29/mo
\nThe famous e-learning course provider offers a wide range of courses in several types of programming languages, web tools and designing. The website offers both free as well as paid versions. With free version users can get access to the 10 introductory courses that include topics like SQL, Objective C, jQuery which are great for getting started. While with the paid version, users can get access to 200 videos and 50+ interesting courses. The website basically works on learn, practice, win and track model which means first the users can learn via watching videos and then challenges are placed in front of them to track their learning experience.
\nPrice : Free
\nThe academy is best for those who prefer short videos to learn things. Started in 2006, by Salman Khan, the idea of this website was generated after creating and sharing video tutorials on Youtube. One of the original e-courses providers, the Khan Academy has become widely popular over the years and offers courses in numerous programming languages, both for beginners as well as experts. Relying heavily on videos, users can learn to code animations, games, drawings and a lot more. For those who are planning to start their coding career, or are beginners at coding, the Khan Academy is the best place.
\nPrice : Free trial for 2 weeks, Basic version at $25/mo and pro version at $50/mo
\nThe online technology courses provider, Treehouse provides programming courses for both beginners as well as experts. The website works on learn, practice and earn model. With 222+ courses, videos, challenges, the website makes sure that the learners are kept busy. Apart from that, it also helps you learn new business strategies to make the best out of your knowledge. But unlike above mentioned options, for this one, you need to spend some cash before you go ahead. The basic version comes at $25/mo with which you get access to around 1000+ videos and can take interesting challenges. While if you go for the pro version at around $50/mo users can unlock the bonus content and download videos to watch offline too.
\nPrice : Free
\nAnother player in the field of online coding courses, the website’s mission is to provide more and more people opportunity to learn programming. The website works more like games with drag & drop tiles. Learners can see the code both during challenge as well as when it is completed.
\nThe next three in the list are massive open online courses provider ie MOOC. These websites provide courses related to not only coding but other fields too like life science, engineering, health habits, etc.
\nPrice : Both free and paid
\nDespite of being founded just 4 years ago, Coursera has become a major Major Open Online Courses provider that offers around 1990 courses from 119 well known institutions. Though there are certain programs that require you to spend money to get certified, there are hundred of other free introductory courses that provide specializations from well known universities like University of Toronto and Vanderbilt, etc. One of the widely popular MOOCs provided by Coursera is “Programming for everybody (Getting started with Python)
\nPrice : Free to hundreds of dollars
\nAnother MOOC provider, Udemy is one place you can find resources for just anything. It is a great place to develop your coding skills with courses like Complete Java Developer Course. Though the courses fee varies from free to hundreds of dollars, Udemy has created its own position when it comes to learning programming. Another feature that it brings along is to allow user to sign up as an instructor and create his/her own course.
\nPrice : Free
\nSimilar to above, this one is also a MOOC provider, serving millions of students around the globe. But this one is a non profit and open source which means anyone can build his own tools and contribute to the edX platform. Some of the most popular edX course is “Fundamentals of Computer Science” by IIT Bombay. Most of the courses I found here were free, but to get a verified certificate you need to spend some cash which differs between the type of courses you are enrolled with.
\nThough there are hundreds of other websites that help you to enhance your coding skills, these are the top ten sites I found to be the best. Have you tried any of these? How was your experience? I would love to know about it in the comments below.
\n","frontmatter":{"date":"October 21, 2016","updated_date":null,"description":null,"title":"Learn How To Code Using The 10 Cool Websites","tags":["Courses","Learning Websites"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.3605442176870748,"src":"/static/fe153e8c041087d5f2b13e90eb01dbb6/630fb/How-to-code-using-the-10-cool-websites-768x564-300x220.png","srcSet":"/static/fe153e8c041087d5f2b13e90eb01dbb6/69585/How-to-code-using-the-10-cool-websites-768x564-300x220.png 200w,\n/static/fe153e8c041087d5f2b13e90eb01dbb6/630fb/How-to-code-using-the-10-cool-websites-768x564-300x220.png 300w","sizes":"(max-width: 300px) 100vw, 300px"}}},"author":{"id":"Team LoginRadius","github":"LoginRadius","avatar":null}}}},{"node":{"excerpt":"Many of the developers believe that they are immune to the need of marketing/branding themselves. As a developer your job is to create…","fields":{"slug":"/engineering/personal-branding-for-developers/"},"html":"Many of the developers believe that they are immune to the need of marketing/branding themselves. As a developer your job is to create ultimate applications, right? After all you are not a celebrity or some rockstar! But isn’t it better to be in demand for fruitful consultations, speaking and writing? Well, all this is possible if you are able to create a personal brand!
\nIn this article I am going to focus on why as a developer you should focus on personal branding, how it is going to help your job and career and finally, will guide you on how you can also create a personal brand. First thing first, let’s start with what is personal branding.
\nWhat is personal branding?
\nThe concept of personal branding is quite similar to that of company branding. Personal branding is all about thinking yourself as a brand. It is about showing people who you are and what is your passion. When you think about some specific programming language, your mind goes back to some specific names associated with that language, who are either the father of that language or have done some amazing work in that field, right?
\nTo get the more clear idea, here is what Paul Irish, the front end developer of Google Chrome team, has to say on the concept of personal branding -
\n“Personal branding is the art of consistently presenting, online and offline, the essence of how you stand out from the crowd.”
\nPersonal branding is all about you and only you :
\nand more! Personal branding is basically about everything that defines you from the languages you are expertize to the blogs you write.
\nWhy you should focus on personal branding?
\nPersonal branding is no longer an option, but it has become crucial for everyone. After all we are living in the digital world where it is simpler to reach to the next level. So it’s not exactly about being the rockstar but maybe it is. May be it is about becoming popular! May be it is about getting that power. Here I am presenting you three key reasons why personal branding is important for you-
\nNo job is permanent!
\nAnother harsh reality! No matter how much your company loves you but you know no job is forever. So be prepared! You don’t know when the situation changes. As a developer personal branding matters when you are looking to change your job. You want your employers to hire you not only as a good developer but also as an innovative leader. To make that possible, you need to cultivate a personal brand that can highlight your value to your potential employers.Sky's the limit!
\nThe process of learning has no end. While creating personal brand, you meet many people from your niche. You interact with them, share your knowledge, learn from them, discuss ideas and all this will give you the level of expertise that wouldn’t have been possible otherwise. Doesn’t matter how you want to improve your career, personal branding is the key!How to manage your personal brand?
\nAs a developer, breaking through the glass ceiling demands much more than excellent programming skills. Cultivating a strong personal brand can really help you out. GET VISIBILITY is all I want to say!
\nYou might have the best expertise in certain technology, you might have designed an amazing product but all this is meaningless if nobody can see you. Here are some tips on how you can get visibility :
\nTry your hand at blogging :
\nBlogging is an amazing way to tell people who you are. Blog about anything you hold expertize in, whether it is a programming language or it is some kind of technology, let people understand who you actually are. There are many developers out there who have some awesome technical blogs where they share their knowledge and write about their specialities.For inspiration you can have a look at the blog of John Resig, the creator and founder of jQuery. Another tech blog champion is Scott Hanselman. Make sure to have a look on his popular blogs www.hanselman.com, hanselminutes, etc.
\nThere are various ways how you can track your brand on social media. My personal favorite is Google Alert which notifies whenever people are talking about me or my projects. While some times they are talking about the work I have done, sometimes they also complaint which helps me understand where I am wrong. There are many others, like on Twitter, you can use Tweetdeck . Apart from that, create a strong persona on Linkedin, Facebook, Google+, etc. Interact with people, reply to their queries and become social media champion.
\nSome popular developers who are social media champions as well include Scott Hanselman, John Resig, etc
Participate in Communities:
\nCommunities like Quora, Stackoverflow, Warrior Forum, etc can be your best friends if you are intending to create brand online. Join these communities and try your best to solve the queries of users from your niche. It will not only help you interact your kind of people but will also improve your problem solving skills. Sites like Stack Overflow, GitHub allow users to work together on projects, that can open a wide opportunity to learn.
\nContribute to Open source or start Open source :
\nAnother great way to cultivate personal brand is to contribute to open source or start open source. While contributing to an open source can be an amazing experience it will earn you recognition among your fellow community. Also you can start open source. If you are getting difficulties to start open source, have a look at this interesting article.
\nWhat I’m trying to say is
\nMaybe you don’t want to become a rockstar developer or you are happy with your current job, but still there is a huge difference between doing the job and doing the job in excellent way. After all, you have worked hard to be where you are today and you deserve to get recognized for it. So why tomorrow, start now and reach the next step.
\n","frontmatter":{"date":"September 23, 2016","updated_date":null,"description":null,"title":"Personal Branding For Developers: Why and How?","tags":["Branding"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1,"src":"/static/ce6fe2aec02784b1878d1ea52335b1c6/aabdf/Personal-Branding-For-Developers-150x150.jpg","srcSet":"/static/ce6fe2aec02784b1878d1ea52335b1c6/aabdf/Personal-Branding-For-Developers-150x150.jpg 150w","sizes":"(max-width: 150px) 100vw, 150px"}}},"author":{"id":"Sreekant","github":null,"avatar":null}}}},{"node":{"excerpt":"I often come across people and clients who would like to build their custom login, registration, and lost password form in WordPress instead…","fields":{"slug":"/engineering/wordpress-custom-login-form-part-1/"},"html":"I often come across people and clients who would like to build their custom login, registration, and lost password form in WordPress instead of using the default wp-login.php page. It's probably because it's too wordpress-y.
\nIn this tutorial, I will demonstrate how to build a custom login form using the default functionality that wordpress gives us.
\n\nThis is what WordPress gives us out of the box.
\nI am going to show you all of this tutorial using the page-theme method because it is probably the easiest to implement for beginners. This will also give you an intro into page themes, if your not familiar with it. To start our theme, you will need to do the following: To initialize this page template, make sure to activate the theme you've selected in \"Appearance/Themes\" in your admin dashboard and then navigate to a page or post. On the right hand side of your page/post editor you should now see a dropdown available for template under \"Page Attributes\". Change your template to \"Login\" or to the name that you specified in \"Template Name:\" and that will attach that page theme to this page/post. Now we're ready to start editing this page-login.php template file. So first open this file in your favorite editor and Let's get a login page started. To quickly show you how to get this login on the page Let's paste the following code between the div with id of content. Look at what that small piece of code do Now we need to set some arguments that we can provide to this form to customize it. Let's take a look at the documentation for wploginform() In that document, it explains all the uses and arguments of wploginform(). Let's use those arguments section and see what happens. Paste the $args section shown in the wordpress doc right above our login form. It will look the same as the one we did earlier but, by customizing the arguments above, you can customize elements of the login form. To handle the Login Form response we need to grab the $_POST parameters and login the user. You can create this as complex as you like, but I will demonstrate a simpler but effective method. For this action, we'll be using the aftersetuptheme and wp_authenticate. I have added the following two functions within the functions.php file. The first function optionalemailaddress_login searches for a users email address based on their username, with this functionality you can log in using your email address or the username. The second function, login_user, handles the actual functionality of the login by receiving the $POST parameters and passing them into the wpsignon method. In this example I have used the default WordPress login form that you could customize and style to your desire. In the next blog, I will be demonstrating how to build a login form that is fully customized. We won’t be using the provided wordpress functions! 1. Secure your server Many known attacks are possible only once physically accessing a machine. For this reason, it is best to have the application server and the database server on different machines. If this is not possible, greater care must be taken, Otherwise, by executing remote commands via an application server, an attacker may be able to harm your database even without permissions. For this reason, any service running on the same machine as the database should be granted the lowest possible permission that still allows the service to operate. 2. Localhost Security or Disable or restrict remote access Consider whether MySQL will be retrieved from the system or directly accessed from its own server. On the off chance that remote access is utilized, guarantee that just characterized hosts can get to the server. This is commonly done through TCP wrappers, IP tables, or some other firewall programming or hardware accessibility tools. skip-networking The document is situated in the \"C:\\Program Files\\MySQL\\MySQL Server 5.1\" catalog on the Windows operating system or \"/etc/my.cnf\" or \"/etc/mysql/my.cnf\" on Linux. Another possible solution is to force MySQL to listen only to the localhost by adding the following line in the [mysqld] section of my.cnfbind-address=127.0.0.1 3. Disable the use of LOCAL INFILE The next change is to disable the use of the \"LOAD DATA LOCAL INFILE\" command, which will help to keep unapproved perusing from neighborhood records. This is particularly vital when new SQL Injection vulnerabilities in PHP applications are found. Or even significantly less difficult: To disable the usage of the \"LOCAL INFILE\" command, the following parameter should be added in the [mysqld] section of the MySQL configuration file. 4. Change root username and password, keep them strong. The default administrator username on the MySQL server is \"root\". Hackers often attempt to gain access to its permissions. To make this task harder, rename \"root\" to something else and provide it with a long, complex alphanumeric password. To rename the administrator’s username, use the rename command in the MySQL console: The MySQL \"RENAME USER\" command first appeared in MySQL version 5.0.2. If you use an older version of MySQL, you can use other commands to rename a user: To change a user’s password, use the following command-line command: It is also possible to change the password using the \"mysqladmin\" utility: 5. Remove the \"Test\" database MySQL comes with a \"test\" database intended as a test space. It can be accessed by the anonymous user, and is therefore used by numerous attacks. Or use the \"mysqladmin\" command: 6. Remove Anonymous and outdated accounts The MySQL database comes with some anonymous users with blank passwords. As a result, anyone can connect to the database to check whether this is the case, do the following: In a secure system, no lines should be echoed back. Another way to do the same: If the grants exist, then anybody can access the database and at least use the default database\"test\". Check this with: To remove the account, execute the following command: The MySQL \"DROP USER\" command is supported starting with MySQL version 5.0. If you use an older version of MySQL, you can remove the account as follows: 7. Increase security with Role Based Access Control A very common database security recommendation is to lower the permissions given to various parties. MySQL is no different. Typically, when developers work, they use the system's maximum permission and give less consideration to permission principles than we might expect. This practice can expose the database to significant risk. In addition, ensure that only the user \"mysql\" and \"root\" have access to the directory 8. Keep a check on database privileges Operating system permissions were fixed in the preceding section. Now let’s talk about database permissions. In most cases, there is an administrator user (the renamed \"root\") and one or more actual users who coexist in the database. Usually, the \"root\" has nothing to do with the data in the database; instead, it is used to maintain the server and its tables, to give and revoke permissions, etc. Only administrator accounts needs to be granted the SUPER / PROCESS /FILE privileges and access to the mysql database. Usually, it is a good idea to lower the administrator’s permissions for accessing the data. Review the privileges of the rest of the users and ensure that these are set appropriately. This can be done using the following steps. [Identify users] [List grants of all users] The above statement has to be executed for each user ! Note that only users who really need root privileges should be granted them. Another interesting privilege is \"SHOW DATABASES\". By default, the command can be used by everyone having access to the MySQL prompt. They can use it to gather information (e.g., getting database names) before attacking the database by, for instance, stealing the data. To prevent this, it is recommended that you follow the procedures described below. To disable the usage of the \"SHOW DATABASES\" command, the following parameter should be added in the [mysqld] section of the [mysqld] 9. Enable Logging If your database server does not execute many queries, it is recommended that you enable transaction logging, by adding the following line to [mysqld] section of the [mysqld] This is not recommended for heavy production MySQL servers because it causes high overhead on the server. Error logEnsure only \"root\" and \"mysql\" have access to the log file \"hostname.err\". The file is stored in the mysql data directory. This file contains very sensitive information such as passwords, addresses, table names, stored procedure names and code parts. It can be used for information gathering, and in some cases, can provide the attacker with the information needed to exploit the database, the machine on which the database is installed, or the data inside it. MySQL logEnsure only \"root\" and \"mysql\" have access to the logfile \"logfile XY\". The file is stored in the mysql data directory. 10. Change the root directory A chroot on UNIX {operating system} operating systems is an operation that changes the apparent disk root directory for the present running method and its children. A program that's re-rooted to a different directory cannot access or name files outside that directory, and therefore the directory is named a \"chroot jail\" or (less commonly) a \"chroot prison\". By using the chroot environment, the write access of the mySQL processes (and child processes) can be limited, increasing the security of the server. Ensure that a dedicated directory exists for the chrooted environment. This should be something like: [client] Thanks to that line of code, there will be no need to supply the mysql, mysqladmin, mysqldump etc. commands with the 11. Delete old logs regularly During the installation procedures, there's plenty of sensitive data which will assist unwelcome users to assault a database. This data is kept within the server’s history and might be terribly useful if one thing goes wrong during the installation. By analyzing the history files, administrators can figure out what has gone wrong and probably fix things up. However, these files are not needed after installation is complete. In conclusion,we should emphasize on database security. However it should be the first thing for any individual or a company. Manipulating collections like arrays and objects can be a hassle with vanilla JS. Thankfully there are libraries like Underscore which offer some extremely useful low level utility functions. Underscore JS provides much of the array/collection/object manipulating functionality similar to what you may have seen in other languages such as Ruby. As for calling the methods if you're familiar with JQuery, Underscore is identical except instead of \"$\" we use the library's namesake \"_\" to access the methods. Underscore has over 100 functions that can be used on collections, arrays, objects and functions (you read that right, function functions). I'm going to be discussing a few of the functions that work on collections, but definitely check out what else Underscore has to offer. Once you know how to re-create the same output with Underscore syntax, you'll never want to go back to plain old JS and using nested for loops. One of the most helpful tools Underscore provides for accomplishing this is... The _each method does exactly what it sounds like. It works on collections (arrays or objects), and will iterate over each element in the collection invoking the function you specified with 3 arguments (value, index, list) with index being replaced by key if used on an object. It's also worth noting _.each returns the list if you want chain some more manipulation after calling _.each. Here's a quick example showing how it can be used and what's available to you when you call it. With that out of the way, let's think about what this means in terms of cleaning up our code. To do the above normally we would write a little for loop like this. Admittedly these two aren't all that different, but let's imagine we have a function defined elsewhere that will deal with handling the arguments passed in on each iteration. We can replace that same functionality with a significantly less verbose solution. To quote Antoine de Saint Exupéry: \"It seems that perfection is attained not when there is nothing more to add, but when there is nothing more to remove.\" While it may not be perfection, there are certainly arguments to be made about performance, I think you would be hard pressed to find anything further simplify this code. While _.each will return the original list you input, _.map will allow you to manipulate or otherwise transform the input as you please and then returns the new array. Map needs a minimum of 2 arguments, first the collection and then the function to be executed on each iteratee and also accepts a third argument which dictates the context for the iterating function. Before you go writing some functions to pass as an argument to _.map be sure to take a peek at the other methods available in Underscore. Map is a little bit like having the Lego blocks to build whatever you want, but if you already have a pre-packaged Batcave available, it might not be the best use of your time building it from scratch. To illustrate my childhood toy analogy let's talk about _.pluck. Pluck is basically just a refined version of _.map made for a specific use case. That's not to say there aren't ways of combining the two to achieve something a little more complex, but if standard _.pluck behaviour is all you're after then don't go re-inventing the wheel. Often with data objects we're interested in the values of a specific key, for example let's say we have an array of movies. Now we want to just have an array of the titles of these movies. Not much else to say about it, it works on collections and is extremely handy for a very common task. Another example of a more refined _.map function that comes in handy often enough. Aptly named this method will return an array of only the things that make it through your test. Works on collections and kitchen sink faucets. Just kidding there's no _.conclusion method. I hope by now that you get the idea that if what you need to do isn't already a method, Underscore's _.map is a powerful tool for accomplishing whatever obscure collection manipulation your heart desires. So get out there, take a look through Underscore JS and start writing less obfuscated (nested) for loops with the help of _.each. LinkedIn has recently revamped their API systems and added many new restrictions. We will go through some examples on how you can utilize the LinkedIn Javascript API in order to setup some useful features that comply with LinkedIn's new terms and conditions and use cases. The first step will be setting up your login button which will prompt the user to authenticate with their LinkedIn credentials. We have provided a guide to getting a basic login button setup here. The linked guide will get you as far as setting up a button that allows your users to login with LinkedIn and display a personalized welcome message. Below we will go over extending this functionality to allow you to handle more complex features for your users after logging in. You can control and initiate specific behavior after a user logs in. You can assign these event handlers by first setting the function that will be used to initialize the events. This will trigger the event designation after the LinkedIn scripts have been loaded on your page. Update the LinkedIn initialization script: This will trigger the onLinkedInLoad function after the Linkedin scripts have been loaded. You can now assign some LinkedIn Event handlers in this function to control the behavior that will occur for different LinkedIn user actions. Let's begin by assigning the behavior that occurs after a user logs in. The above event will trigger when a user authorizes and will call the getProfileData function. We can add another event assignment for the user logging out. The above logout event will trigger the sendGoodByeMessage when the user logs out. Now that we have the basic event handling in place we can handle the specific behavior for users logging in. Once a user has logged in and triggered the getProfileData event we can pull in their user profile using the LinkedIn Raw data API handlers, these allow you to access any of LinkedIn's API endpoints and get data back. We will begin with a quick check to make sure the user is still authorized and then call the Raw API to pull in the people endpoint for the current user: If the data is successfully returned it will call the onSuccess function and if not it will call onError. These functions will both include a JSON formatted response that can be used to display their profile data or log a message: You can test the response formats for most of the LinkedIn APIs on LinkedIns API console You can access any of the API endpoints after successful login via the raw API handler and retrieve data per your requirements. Before making any API requests you should verify that your user has a current active session. User sessions are valid for 30 minutes by default. These sessions can be extended using the following call: The above call can be used to refresh the expiration time for the user but repeated calls may cause your app to be blocked so this should be used sparingly. You can provide the ability for your users to logout by setting up a button or link that will trigger the following function call: This will trigger the same function that was assigned to the logout event. Google has prepared a roadmap to restrict third-party cookies in Chrome. Since 04 January 2024, Chrome has rolled out third-party cookie restrictions for 1% of stable clients and 20% of Canary, Dev, and Beta clients. What does it mean for user authentication? On one hand, Google believes third-party cookies are widely used for cross-site tracking, greatly affecting user privacy. Hence, Google wants to phase out (or restrict) supporting third-party cookies in Chrome by early Q2 2025 (subject to regulatory processes). On the other hand, Google introduced Privacy Sandbox to support the use cases (other than cross-site tracking and advertising) previously implemented using third-party cookies. In this article, we’ll discuss: Third-party cookie restrictions affect user authentication in three ways, as follows. If your website or app uses an external Identity Provider (IdP) — like LoginRadius, the IdP sets a third-party cookie when the user authenticates on your app. If you have multiple apps across domains within your organization and authentication is handled using an IdP (internal or external) with web SSO, you already use third-party cookies to facilitate seamless access for each user using a single set of credentials. If you have implemented web SSO with one primary domain and multiple sub-domains of the primary domain, third-party cookie restrictions may not apply. For now, Google doesn’t consider the cookies set by sub-domains as third-party cookies, although this stance may change in the future. For example, you have apps at Federated SSO is similar to, albeit different from, web SSO. It can handle multiple IdPs and applications—aka., Service Providers (SPs)—spanning multiple organizations. It can also implement authentication scenarios that are usually implemented through web SSO. Usually, authentication is handled on a separate pop-up or page when the user wants to authenticate rather than on the application or website a user visits. For example, you already use federated SSO if you facilitate authentication for a set of apps through multiple social identity providers as well as traditional usernames and passwords. Note: It is also possible to store tokens locally, not within cookies. In this case, third-party cookie restrictions won’t affect token-based authentication. However, the restrictions still affect authentication where tokens are stored within third-party cookies (a common and secure method). Google has been developing alternative features and capabilities for Chrome to replace third-party cookies as part of its Privacy Sandbox for Web initiative. Specific to authentication, Google recommends the following: CHIPS are a restricted way of setting third-party cookies on a top-level site without making them accessible on other top-level sites. Thus, they limit cross-site tracking and enable specific cross-site functionalities, such as maps, chat, and payment embeds. For example, a user visits If the user visits You should specifically opt for partitioned cookies (CHIPS), which are set with partitioned and secure cookie attributes. If you’re using an external identity provider for your application, CHIPS is a good option to supplant third-party cookie restrictions. However, CHIPS may not be ideal if you have a web SSO or federated SSO implementation. It creates separate partitioned cookies for each application with a separate domain, which can increase complexity and create compatibility issues. With Storage Access API, you can access the local storage in a third-party context through iframes, similar to when users visit it as a top-level site in a first-party context. That is, it gives access to unpartitioned cookies and storage. Storage Access API requires explicit user approval to grant access, similar to locations, camera, and microphone permissions. If the user denies access, unpartitioned cookies and storage won’t be accessible in a third-party context. It is most suitable when loading cross-site resources and interactions, such as: Verifying user sessions when allowing interactions on an embedded social post or providing personalization for an embedded video.\nEmbedded documents requiring user verification status to be accessible. As it requires explicit user approval, it is advisable to use Storage Access API when you can’t implement an identity use case with the other options. With Related Website Sets, you can declare a Chrome automatically recognizes related website sets declared, accepted, and maintained in this open-source GitHub repository: Related Website Sets It provides access through Storage Access API directly without prompting for user approval, but only after the user interacts with the relevant iframe. It is important to declare a limited number of domains in related website sets that are meaningful and used for specific purposes. Google may block or suspend any exploitative use of this feature. The top-level site can also request approval for specific cross-site resources and scripts to Storage Access API using If you’re using an external identity provider for your web application, you can declare the domain of the identity provider in the related set to ensure limited third-party cookies and storage access to the identity provider, thus ensuring seamless user authentication. Related Website Sets can also work to supplement third-party cookie restrictions in web SSO and federated SSO if the number of web applications (or domains) is limited. FedCM API enables federated SSO without third-party cookies. With FedCM API, a user follows these steps for authentication: You can access a user demo of FedCM here: FedCM. For more information about implementing federated SSO with FedCM API, go through the FedCM developer guide. Firstly, we’re committed to solving our customers' user identity pain points — and preparing for the third-party cookies phase-out is no different. We’ll implement the most relevant and widely useful solutions to facilitate a smooth transition for our customers. Please subscribe to our blog for more information. We’ll update you on how we help with the third-party cookie phase-out. The proposed changes to phase out third-party cookies and suggested alternatives are evolving as Google has been actively collaborating and discussing changes with the border community. Moreover, browsers like Firefox, Safari, and Edge may approach restricting third-party cookies differently than Google does. From LoginRadius, we’ll keep you updated on what we’re doing as a leading Customer Identity and Access Management (CIAM) vendor to prepare for the third-party cookie phase-out. Top-level site: It is the primary site a user has visited. First-party cookie: A cookie set by the top-level site. Third-party cookie: A cookie set by a domain other than the top-level site. For example, let’s assume that a user has visited \n
\n
\n<?php\n/*\nTemplate Name: Login\n*/\n \nget_header(); ?>\n \n<div id="primary" class="content-area">\n<div id="content" class="site-content" role="main">\n \n</div><!-- #content -->\n</div><!-- #primary -->\n \n<?php get_sidebar(); ?>\n<?php get_footer(); ?>
\n<div id="primary" class="content-area">\n<div id="content" class="site-content" role="main">\n<?php wp_login_form(); ?>\n</div><!-- #content -->\n</div><!-- #primary -->
\n<?php $args = array(\n'echo' => true,\n'redirect' => ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],\n'form_id' => 'loginform',\n'label_username' => __( 'Username' ),\n'label_password' => __( 'Password' ),\n'label_remember' => __( 'Remember Me' ),\n'label_log_in' => __( 'Log In' ),\n'id_username' => 'user_login',\n'id_password' => 'user_pass',\n'id_remember' => 'rememberme',\n'id_submit' => 'wp-submit',\n'remember' => true,\n'value_username' => '',\n'value_remember' => false\n); ?>\n<?php wp_login_form( $args ); ?>Handling the login form response (Custom)
\n
\n/**\n* optional_email_address_login allows the user\n* to log in with a email address as well as a username\n* @param string &$username username or email\n* @param string &$password password\n*/\nfunction optional_email_address_login( &$username, &$password ) {\n$user = get_user_by( 'email', $username );\nif ( ! empty( $user->user_login ) )\n{\n$username = $user->user_login;\n}\n}\n// Allows the use of email logins\nadd_action( 'wp_authenticate', 'optional_email_address_login', 1, 2 );\n \n/**\n* login_user handles the $_POST array and logs in users\n*/\nfunction login_user() {\nif ( ! is_user_logged_in() ) {\n$creds = array();\n$creds['user_login'] = isset( $_POST['log'] ) ? $_POST['log'] : '';\n$creds['user_password'] = isset( $_POST['pwd'] ) ? $_POST['pwd'] : '';\n$creds['remember'] = isset( $_POST['rememberme'] ) ? true : false;\n$user = wp_signon( $creds, false );\n \nif ( is_wp_error( $user ) ) {\nerror_log( $user->get_error_message() );\n}\n}\n}\n// Run login_user before headers and cookies are sent\nadd_action( 'after_setup_theme', 'login_user' );
\nTo confine MySQL from opening a network socket, the accompanying parameter ought to be included in the [mysqld] area of my.cnf or my.ini:
\nThis line cripples the start of systems administration in the middle of MySQL startup. It would be ideal if you bear in mind that a local connection can be used set up a connection to the MySQL server.
\nYou may not be willing to incapacitate system access to your database server if clients in your organization interface with the server from their machines or the web server introduced on an alternate machine. In that case, the following restrictive grant syntax should be considered:
\nmysql> GRANT SELECT, INSERT ON mydb.\\* TO 'someuser'@'somehost';
\nIn addition, in certain cases, the \"LOCAL INFILE\" command can be used to gain access to other files on the operating system, for instance \"/etc/passwd\", using the following command:
\nmysql> LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE table1
\nmysql> SELECT load\\_file("/etc/passwd")
\nset-variable=local-infile=0
\nmysql> RENAME USER root TO new\\_user;
\nmysql> use mysql;\n\nmysql> update user set user="new\\_user" where user="root";\n\nmysql> flush privileges;
\nmysql> SET PASSWORD FOR 'username'@'%hostname' = PASSWORD('newpass');
\nshell> mysqladmin -u username -p password newpass
\nTo remove this database, use the drop command as follows:
\nmysql> drop database test;
\nshell> mysqladmin -u username -p drop test
\nmysql> select \\* from mysql.user where user="";
\nmysql> SHOW GRANTS FOR ''@'localhost';\n\nmysql> SHOW GRANTS FOR ''@'myhost';
\nshell> mysql -u blablabla
\nmysql> DROP USER "";
\nmysql> use mysql;\n\nmysql> DELETE FROM user WHERE user="";\n\nmysql> flush privileges;
\n* Any new MySQL 5.x installation already installed using the correct security measures.
\nTo protect your database, make sure that the file directory in which the MySQL database is actually stored is owned by the user \"mysql\" and the group \"mysql\".
\nshell>ls -l /var/lib/mysql/var/lib/mysql.
\nThe mysql binaries, which reside under the /usr/bin/ directory, should be owned by \"root\" or the specific system \"mysql\" user. Other users should not have write access to these files.
\nshell>ls -l /usr/bin/my\\*
\nOn the other hand, some user ids are used to access the data, such as the user id assigned to the web server to execute \"select\\update\\insert\\delete\" queries and to execute stored procedures. In most cases, no other users are necessary; however, only you, as a system administrator can really know your application’s needs.
\nmysql> use mysql;
\nmysql> select \\* from users;
\nmysql> show grants for ‘root’@’localhost’;\n
\n/etc/my.cnf:
\nskip-show-database /etc/my.cnf file:
\nlog =/var/log/mylogfile
\nIn addition, verify that only the \"root\" and \"mysql\" ids have access to these logfiles (at least write access)./chroot/mysql In addition, to make the use of the database administrative tools convenient, the following parameter should be changed in the [client] section of MySQL configuration file:
\nsocket = /chroot/mysql/tmp/mysql.sock--socket=/chroot/mysql/tmp/mysql.sock parameter every time these tools are run.
\nWe should remove the content of the MySQL history file (~/.mysql_history), wherever all dead SQL commands are kept (especially passwords, that are kept as plain text):
\ncat /dev/null > ~/.mysql\\_history_.each
\n
\nvar someArray = ["a", "b", "c"];\n \n_.each(someArray, function (element, index, list) {\n console.log("value: " + element + " index: " + index + " list: " + list)\n});\n \n// outputs\nvalue: a index: 0 list: a,b,c\nvalue: b index: 1 list: a,b,c\nvalue: c index: 2 list: a,b,c
\nfor ( var i = 0; i < someArray.length; i++) {\n console.log("value: " + someArray[i] + " index: " + i + " list: " + someArray);\n}
\n_.each(someArray, doStuff);_.map
\n
\nvar numbersObject = {1:1, 2:4, 3:9};\n \nvar productArray = _.map(numbersObject, function(value, key) {\n return value * key;\n});\n \n//proudctArray is now\n[1, 8, 27]_.pluck
\n
\nvar movies = [\n {title: "Dracula", genre: "Horror", star: "Nosferatu"},\n {title: "Cast Away", genre: "Drama", star: "Wilson"},\n {title: "Airplane", genre: "Comedy", star: "Leslie Nielsen"}\n];
\nvar titlesArray = _.pluck(movies, 'title');\n \n//titlesArray is now\n["Dracula", "Cast Away", "Airplane"]_.filter
\n
\nvar numbers = [1,33,6,24,8,21,11,22];\n \nvar lessThanTen = _.filter(numbers, function(number) {\n return number < 10;\n});\n \n//lessThanTen is now\n[1, 6, 8]_.conclusion
\nGetting Your Site Ready
\nEvent Handling
\n
\n<!--\napi_key: \nauthorize: true\nonLoad: onLinkedInLoad\n-->
\n<!--\nfunction onLinkedInLoad() {\n IN.Event.on(IN, "auth", getProfileData);\n}\n-->
\n<!--\nfunction onLinkedInLoad() {\n IN.Event.on(IN, "auth", getProfileData);\n IN.Event.on(IN, "logout", sendGoodByeMessage);\n}\n-->Data Retrieval and API access
\n
\n<!--\nfunction getProfileData() {\n if(IN.User.isAuthorized())\n IN.API.Raw("/people/~").result(onSuccess).error(onError);\n}\n-->
\n<!--\nfunction onSuccess(data) {\n console.log(data);\n}\nfunction onError(error) {\n console.log(error);\n}\n-->User Management
\n
\n<!--\nIN.User.refresh()\n-->
\n<!--\nIN.User.logout(sendGoodByeMessage);\n-->\n
\nHow is User Authentication Affected?
\nExternal Identity Providers
\nWeb SSO
\nexample.com, travel.example.com, stay.example.com, and web SSO is handled by auth.example.com. In this case, third-party cookie restrictions don’t apply.Federated SSO
\n\n
\nChrome’s Alternatives for Third-Party Cookies
\n\n
\nCookies Having Independent Partitioned State (CHIPS)
\na.com with a map embed from map-example.com, which can set a partitioned cookie that is only accessible on a.com. b.com with a map embed from map-example.com, it cannot access the partitioned cookie set on a.com. It has to create a separate partitioned cookie specific to b.com, thus blocking cross-site tracking yet allowing limited cross-site functionality.Storage Access API
\nRelated Website Sets
\nprimary website and associatedSites for limited purposes to grant third-party cookie access and local storage for a limited number of sites.resuestStorageAccessFor() API.Federated Credential Management (FedCM) API
\n\n
\nHow is LoginRadius Preparing for the Third-party Cookie Phase-out?
\nIn Conclusion
\nGlossary
\na.com, which might use an embed from loginradius.com to facilitate authentication. If loginradius.com sets a cookie when the user visits a.com, it is called a third-party cookie as the user hasn’t directly visited loginradius.com.References
\n\n","frontmatter":{"date":"July 08, 2024","updated_date":null,"description":"Google Chrome has planned to phase out third-party cookies, which will affect different website functionalities depending on third-party cookies. This blog focuses on how this phase-out affects identity and user authentication and discusses alternatives for overcoming challenges.","title":"How Chrome’s Third-Party Cookie Restrictions Affect User Authentication?","tags":["Identity","Cookies","Chrome"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/eb7396060c0adc430dbed2d04b63d431/ee604/third-party-cookies-phaseout-chrome.png","srcSet":"/static/eb7396060c0adc430dbed2d04b63d431/69585/third-party-cookies-phaseout-chrome.png 200w,\n/static/eb7396060c0adc430dbed2d04b63d431/497c6/third-party-cookies-phaseout-chrome.png 400w,\n/static/eb7396060c0adc430dbed2d04b63d431/ee604/third-party-cookies-phaseout-chrome.png 800w,\n/static/eb7396060c0adc430dbed2d04b63d431/f3583/third-party-cookies-phaseout-chrome.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Raghunath Reddy","github":"raghunath-r-a","avatar":null}}}},"pageContext":{"limit":6,"skip":252,"currentPage":43,"type":"//engineering//","numPages":52,"pinned":"17fa0d7b-34c8-51c4-b047-df5e2bbaeedb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}