HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
nitram509
macaroons.js
HTML2015–2020
nitram509 / macaroons.js

macaroons.js

Javascript implementation of Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud.

Web DevelopmentSecurity & PrivacyDevOps & CloudLibraries & SDKs
Explore on GitHubRead Hacker News discussions
7Distinct people
9Mentions
0Explicit recommenders
80GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Javascript implementation of Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year9 dated mentions

Observed mentions: 2015-05-28 13:20:15 UTC to 2020-04-02 00:09:22 UTC.

01232015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2020

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC101
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC000
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC202
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC303
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC303

What Hacker News says

9 sources
carapace·Apr 2, 2020
There's something called "Macaroons" that can be used for this. "Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud" Arnar Birgisson, Joe Gibbs Politz, Úlfar Erlingsson, Ankur Taly, Michael Vrable, Mark Lentczner ; Network and Distributed System Security Symposium, Internet Society (2014) https://research.google/pubs/pub41892/ "Google's Macaroons in Five Minutes or Less" https://blog.bren2010.io/2014/12/04/macaroons.html A Javascript implementation: https://github.com/nitram509/macaroons.js
In Capability Myths Demolished (2003)
Ficirdly·Feb 18, 2020
Just not Macaroons again :( Macaroons have many small edge cases that'll bite you when you try to use them in practice: - there is no spec and all people re-implement the de-facto standard. If you read the whitepaper it's not what's in use. - the de-facto implementation is full of holes, e.g. time is expressed without timezone so it's not clear if it's UTC or not. - the implementation requires custom parser for custom binary format but the caveats in wild use (remember: there are no standard ones) still use text so it just avoids the potential benefits of encoding dates and numbers in binary. - the highly hyped third-party macaroons are barely supported in implementations in the wild - only one level is allowed and it's not specified anywhere. - if we're talking about third-party macaroons there is another layer of problems: no standard f
Read the rest
or caveats means your third-party service needs to be closely coupled with your own. - immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma... JWTs have many problems but compared to Macaroons it's just JSON and base64. This is available in all programming languages with no additional cost. JWTs also have actual spec that implementations can agree on. Macaroons promise you extreme power but doesn't deliver. Several of Macaroons issues could be resolved with some effort (e.g. standarization) others - like resolving cycles in third-party caveats are IMO design flaws deeply embedded in the format. For more info from people deploying Macaroons in the wild see https://www.youtube.com/watch?v=MZFv62qz8RU As for tptacek's recommendation this only serves as a reminder that even if a highly respected internet figure recommends you something you still need to do your own homework instead of blindly following.
In JWT is Awesome
Boulth·Aug 30, 2018
I wouldn't recommend Macaroons so lightly. I spent 2 months researching them for internal use, reimplemening them from the paper and comparing with existing implementations. There are numerous practical issues with Macaroons: the caveat format is not standardized (both binary and allowed claim types), that matters a lot when using third party caveats. There are some de facto formats but they are full of issues (e.g. date format not exactly ISO). Validation of a set of Macaroons requires walking a graph, that needs cycle detection, implementations that I've checked do not allow nested third party caveats, that invalidates one reason to use them. Attenuation is nice but it doesn't play nice with third party caveats (hash is used as a key for decryption, appending to a third party caveat changes hash). Then there are implementation errors su
Read the rest
ch as: https://github.com/nitram509/macaroons.js/blob/master/lib/Cr... Some of these issues could be removed by slightly changing implementations but the de facto implementation basically froze it. (then there is a fact that the de facto impl already changed some aspects from the paper, e.g. calculation of hash for appended third party caveat).
In Why JWTs Suck as Session Tokens (2017)
Boulth·Aug 30, 2018
Because they have a lot of complexity that, for a code they runs a part of auth logic, is really dangerous. For example, verification of third party Macaroons requires building a directed graph, that needs cycle detection. No implementation that I've checked does this instead allowing only one level of nesting. Third party caveats have more problems, if a third party would issue them they need to be standardized but there is no such standard. Worse, even the underlying byte format is not standardized instead there is this de facto standard of using "variable op value" format. But what variables are supported? It needs to be specified or the third party macaroon would be invalid. If we talk about byte formats Macaroons are serialized using another custom format. Compare this with base64 and JSON used by JWT. Then there are certain "program
Read the rest
ming shortcuts" in implementations [0]. I've spent some time implementing Javascript library to build and verify Macaroons from the paper (that is also inconsistent with the de facto implementations) but ultimately I've decided to just use limited subset of JWT. It's just simpler. [0]: https://github.com/nitram509/macaroons.js/blob/master/lib/Cr...
In Approaching Access Control on the Web (Part I)
Shoothe·Jan 5, 2018
Macaroons have many moving pieces, caveats being just one of them. Standardization would have to approach it from all edges. For example the binary format while simple is also "de facto" standard resembling protobuf but not exactly. Maybe CBOR would be a good idea (or a subset of it)? As for caveats there are two forces at place: some want simple format ("X op Y") but there is another way that I've explored in a PoC - use simple stack-based script system (similar to Bitcoin Script [0]), then you can encode some really interesting properties inside your tokens (like requiring hashes of different properties, or signatures) so it would be kind of a meta-authorization scheme where you can delay the decision (e.g. require EC signatures for some sensitive operations). Of course this brings additional complexity but on the other hand using cavea
Read the rest
ts in "X op Y" form doesn't bring any benefits over JWT claims. [0]: https://en.bitcoin.it/wiki/Script The ultimate reason why I abandoned Macaroons (after working for some prototypes and creating a JS library for them) is just the amount of complexity needed to work with them. And remember - code working with Macaroons is being executed before the request is authorized (that's what they are for) so this code need to be carefully audited and any bug can have severe consequences. Compare that with JWT, you can write a verifier in simple code (JSON and base64 are built-in in any language) and simple is easier to audit. In Macaroons you first need to decode base64, parse custom binary format, check consistency (no cycles in third-party caveats), decrypt third-party keys. Moreover there can be multiple Macaroons for given ID, you need to check if at least one satisfies the request. Better - check all of them and then see if at least one works (to protect against side-channel attacks). So there is some inherent complexity in the entire stack. Removing it would require some substantial work. IMHO that's why they are not widely used. Oh, did I mention the existing libraries have some rather significant issues [1]? [1]: https://github.com/nitram509/macaroons.js/blob/master/src/ma... So to answer your question: I would gladly see some standarization effort, but it needs to be really thorough to have good effect. Unfortunately Macaroons are already plagued by old cruft (e.g. third-party caveats ID are called "cid" and first party caveats are also called "cid" but they are completely different) that no-one wants to touch not to break existing code. If you don't mind we can keep the discussion here, it's good for others to see (I got into Macaroons because of one of these threads) and it's google-able :)
In Show HN: PAST, a secure alternative to JWT
hdhzy·Jun 8, 2017
OSS is no silver bullet - you still have to do your due diligence to have secure system. OSS just gives you an option to "fix it yourself". Just recently I was reading a library and stumbled upon this interesting crypto tidbit [0] ("XXX get some random bytes instead"). Maybe a paid engineer would've designed it better but history is full of counter-examples (see CVE-2017-5689 [1]). [0]: https://github.com/nitram509/macaroons.js/blob/master/src/ma... [1]: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5689
In XSS Attacks: The Next Wave

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.