Skip to content

← Back to top all-time

nitram509

macaroons.js

HTML2015–2020

nitram509 / macaroons.js

macaroons.js

Javascript implementation of Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud.

Web Development Security & Privacy DevOps & Cloud Libraries & SDKs

Explore on GitHub Read Hacker News discussions

7Distinct people

9Mentions

0Explicit recommenders

80GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Javascript implementation of Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:02:05 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year9 dated mentions

Observed mentions: 2015-05-28 13:20:15 UTC to 2020-04-02 00:09:22 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	1	0	1
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	0	0	0
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	2	0	2
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	3	0	3
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	0	0	0
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	3	0	3

What Hacker News says

3 sources

carapace·Apr 2, 2020

There's something called "Macaroons" that can be used for this. "Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud" Arnar Birgisson, Joe Gibbs Politz, Úlfar Erlingsson, Ankur Taly, Michael Vrable, Mark Lentczner ; Network and Distributed System Security Symposium, Internet Society (2014) https://research.google/pubs/pub41892/ "Google's Macaroons in Five Minutes or Less" https://blog.bren2010.io/2014/12/04/macaroons.html A Javascript implementation: https://github.com/nitram509/macaroons.js

In Capability Myths Demolished (2003)

oefrha·Feb 18, 2020

> - immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma... Wow. In case the master changes, here’s the highlighted code: /* XXX get some random bytes instead */ var enc_plaintext:Buffer = new Buffer(MacaroonsConstants.MACAROON_HASH_BYTES); enc_plaintext.fill(0); This library’s README should have an all cap “toy project, don’t use” up top.

In JWT is Awesome

Ficirdly·Feb 18, 2020

Just not Macaroons again :( Macaroons have many small edge cases that'll bite you when you try to use them in practice: - there is no spec and all people re-implement the de-facto standard. If you read the whitepaper it's not what's in use. - the de-facto implementation is full of holes, e.g. time is expressed without timezone so it's not clear if it's UTC or not. - the implementation requires custom parser for custom binary format but the caveats in wild use (remember: there are no standard ones) still use text so it just avoids the potential benefits of encoding dates and numbers in binary. - the highly hyped third-party macaroons are barely supported in implementations in the wild - only one level is allowed and it's not specified anywhere. - if we're talking about third-party macaroons there is another layer of problems: no standard f

Read the rest

or caveats means your third-party service needs to be closely coupled with your own. - immature implementations, I'll just leave this here: https://github.com/nitram509/macaroons.js/blob/master/src/ma... JWTs have many problems but compared to Macaroons it's just JSON and base64. This is available in all programming languages with no additional cost. JWTs also have actual spec that implementations can agree on. Macaroons promise you extreme power but doesn't deliver. Several of Macaroons issues could be resolved with some effort (e.g. standarization) others - like resolving cycles in third-party caveats are IMO design flaws deeply embedded in the format. For more info from people deploying Macaroons in the wild see https://www.youtube.com/watch?v=MZFv62qz8RU As for tptacek's recommendation this only serves as a reminder that even if a highly respected internet figure recommends you something you still need to do your own homework instead of blindly following.

In JWT is Awesome