Sergio Xalambri

Sergio Xalambri

@sergiodxa.com

Writing "React Router OAuth2 Handbook" Web Developer at Daffy.org Blogger at sergiodxa.com Open Source Author at GitHub.com/sergiodxa Sponsor me at https://github.com/sponsors/sergiodxa

742 followers195 following54 posts

Another @remix.run v3 + state management library example, now Stately.ai's xstate. Define the machine once, create the actor and subscribe to updates in the setup scope, and get a snapshot or send events on the render scope. Full code: github.com/sergiodxa/re...

Sergio Xalambri@sergiodxa.com

Next on @remix.run v3 + state management libraries, I tried @preactjs.com Signals core package. This requires to run the effect to subscribe to the signal inside this.queueTask, otherwise it tries to re-render before Remix did the first render. Full code: github.com/sergiodxa/re...

Next on @remix.run v3 + state management libraries, I tried @preactjs.com Signals core package. This requires to run the effect to subscribe to the signal inside this.queueTask, otherwise it tries to re-render before Remix did the first render. Full code: github.com/sergiodxa/re...

Sergio Xalambri@sergiodxa.com

I'm trying different state management libraries, common in React, that have a JS only core and see how they integrate with @remix.run v3. I started with Redux Toolkit. Super simple and straightforward to setup and use. Code here: github.com/sergiodxa/re...

Sergio Xalambri reposted

In June we announced an open governance model for React Router. Today, we are excited to welcome Sergio Xalambrí and @rossipedia.com to the React Router Steering Committee! Both have made valuable contributions to Remix and React Router over the years, and we appreciate their feedback.

In OAuth2 + OIDC, each token has a different audience: 🔑 Access Token → Resource Server 🔄 Refresh Token → Authorization Server 🪪 ID Token → Client App Each audience ensures the token is used by the right party and for the right purpose.

View full thread

🪪 The ID Token’s audience is the Client Application. It contains user identity info and is meant to be consumed by the client, not by the API or auth server. That’s why its aud claim matches the client’s ID.

In OAuth2 + OIDC, each token has a different audience: 🔑 Access Token → Resource Server 🔄 Refresh Token → Authorization Server 🪪 ID Token → Client App Each audience ensures the token is used by the right party and for the right purpose.

🔑 The Access Token's audience is the Resource Server. It’s the one that will validate and accept the token to give access to protected resources. This way, only the Resource Server can rely on it—it’s not meant for the client or the auth server.

🔄 The Refresh Token’s audience is the Authorization Server. It’s the only one allowed to accept it and issue a new Access Token. This keeps refresh logic centralized and secure, preventing misuse by clients or other services.

From time to time I want to see if Web Components improved They could have been way better if we started with a simple partial defined using the <template> tag and a name attribute <template name="user-item"> some html here </template> Then you do `<user-item>` and the browser inline the partial

View full thread

Pair all of that with import maps and we could have HTML partials, scoped styles and JS files for WC cached forever And because it starts with HTML instead of JS like WC it could go from something super simple to avoid repetition to a more advanced component Like a Progressive Web Component API

I can imagine web frameworks like Ruby on Rails, Django, Laravel, etc. adding support for this at their template level, imagine Rails partials generating this Progressive WC for you so you don't have to do it yourself It could even load the correct HTML imports in your views

From time to time I want to see if Web Components improved They could have been way better if we started with a simple partial defined using the <template> tag and a name attribute <template name="user-item"> some html here </template> Then you do `<user-item>` and the browser inline the partial

View full thread

To add scoped styles we could make it so any <style> or <link rel="stylesheet"> inside a <template> is automatically scoped to that partial <template name="user-item"> <link rel="stylesheet" href="/styles/user-item.css" /> some HTML here </template> Something like that ☝️

To add interactivity, we could also load a JS file inside the template If this JS has an `export default` with a class extending HTMLElement the browser could automatically instantiate it with a reference to the partial DOM reference to let you add events or manipulate it

From time to time I want to see if Web Components improved They could have been way better if we started with a simple partial defined using the <template> tag and a name attribute <template name="user-item"> some html here </template> Then you do `<user-item>` and the browser inline the partial

And to share it between pages and get it cached use HTML imports: <link rel="import" href="/partials/user-item.html" /> If you want to cache it forever, hash the file name <link rel="import" href="/partials/user-item.HASH.html" />

🤔 I wonder if it would be possible to self host a Blueksy Personal Data Server on #Cloudflare Worker with D1

Kelsey Hightower@kelseyhightower.com

The Bluesky team earned my trust by delivering on promise after promise, including the ability to host your own data. It isn't just possible, it's now well documented. atproto.com/guides/self-...

I have been working on a React Router v7 starter for Cloudflare Workers and yesterday I tried it myself to build a simple AI Chat app using Workers AI, I spent more time building the UI than actually building the app I spent 0 seconds on auth as that comes built-in github.com/edgefirst-de...

github.comGitHub - edgefirst-dev/starter-ai-chat: A starter repo for an AI chatbotA starter repo for an AI chatbot. Contribute to edgefirst-dev/starter-ai-chat development by creating an account on GitHub.

You are up to date.