Chad Killingsworth

Chad leads engineering for the Banno platform at Jack Henry & Associates where he builds modern online banking experiences for US banks using web components.

[Malte Ubl @cramforce]

You can just ship things

[Chad Killingsworth @chadhikes]

@cramforce My favorite task is to work on core vitals scores for our app for this very reason. Another good one is to improve automated tests. Nobody gives love to test suites.

[Chad Killingsworth @chadhikes]

@cramforce Doesn't matter if you don't update it. Azure Status page is frequently just a lie. I've had an entire region affected and no status.

[Jason Miller 🦊⚛ @_developit]

Persisted Signals

const count = persistedSignal(0, 'count')
console.log(`page loaded ${++count.value} times`)

https://t.co/ATcGz7YHLY

[Chad Killingsworth @chadhikes]

@justinfagnani You've worked hard on this for a long time. Nice job!

[Chad Killingsworth @chadhikes]

@cramforce I 100% agree. The one-sided crusade to destroy them directly affects multiple integrations that used them only for positive outcomes (AKA not tracking). I just want auth to work in my iframes ...

[Chad Killingsworth @chadhikes]

@samthor Are you missing closure types already?

[Chad Killingsworth @chadhikes]

Did you know that import maps can be used to solve the waterfall problem and improve caching for your PWA? Our apps are now shipping import maps to production to address this. https://t.co/gbYTSEfZVB

[Chad Killingsworth @chadhikes]

After working on a large ES module project that runs 100% in a modern browser without a build first, switching to anything that requires a build step for development makes me groan.

[Chad Killingsworth @chadhikes]

@rob_dodson @slightlylate You can also later run the TS compiler against those types like a linter and not actually use the output.

[Chad Killingsworth @chadhikes]

@samthor I miss catching up at conferences.

[Chad Killingsworth @chadhikes]

Looking forward to the future spec changes which will make the user experience so much better.

[Chad Killingsworth @chadhikes]

Over 4 million bank and credit union customers on the @BannoJHA platform can now login to their online banking site using biometrics thanks to #WebAuthN. Can your bank do that?

[Chad Killingsworth @chadhikes]

#WebAuthN for primary factor logins was an incredibly challenging project. We spent a lot more time talking about the use cases than actually implementing it. You can read more about what makes it difficult at https://t.co/nBKddeBskS

[Chad Killingsworth @chadhikes]

@MykeBates @dbkahn Without the protection of the HTTPOnly flag on cookies and without a content security policy any such auth token is very susceptible to theft.

[Chad Killingsworth @chadhikes]

With the upcoming end of 3rd party cookies I am seeing a rise in cookieless auth solutions particularly for framed content. These same apps rarely have content security policy. I forsee this going very badly.

[Chad Killingsworth @chadhikes]

@samthor @cramforce Are you assuming a cache first strategy for the html to get this advantage?

[Chad Killingsworth @chadhikes]

@cramforce @tokumin Prompting in app to update helps along with the ability to force an update. For security reasons our apps allow forced updates but we try to avoid using that feature.

[Chad Killingsworth @chadhikes]

@jakedolan Google Assistant acts as the OAuth client and calls a 3rd party OAuth server. It has very very few options. It's the Google client that doesn't support PKCE.

[Chad Killingsworth @chadhikes]

Playing around with account linking and Google Assistant actions. Why on earth is PKCE for OAuth2 not supported? The draft OAuth 2.1 spec requires it.