Password column not included

Eduardo Orive Vinuesa — Sun, 08 Nov 2026 12:09:35 +0000

This will be very very strange statement to many readers. How an USERS table would miss such critical column? I hope in a few lines you can get the point of it.

However strange, keeping the authentication out of your API databases could be a smart approach:

The platform is publicly accessible, by real people, programs or entities capable of making use of it.
There is real chance that the platform is targeted to obtain it's sensitive data.
The platform is distributed in different APIs, Web user's interfaces, processes, CLI tools, you name it.

Well, and then, how we provide an authentication mechanism to access the platform?

Use an identity and access management (IAM) such as Keycloak (however there are plenty of alternatives out there, also open source)

Why take the overhead to use another service for authentication?

These are reality proven secure services, afford that these teams and their investors can put much more resources to keep them safe.
Their flexibility is something that you may not need, but if you finally find out you need third party authentication, applications, more than one realm, this will do.
You can provide your own JWTs but if your platform is complex enough a authentication endpoint will be needed.

There is however an issue of using this approach: JWTs are self-contained, so they stay valid until they expire — even after the user logs out. Common mitigations:

Short-lived access tokens + refresh tokens; revoke the refresh token on logout.
A denylist of revoked token ids (jti).
If you need instant revocation, trade statelessness for Keycloak's token introspection endpoint (RFC 7662).

Hope this will help you if you didn't knew about it, for sure this was helpful for me.

Preact SPA into a Wordpress theme

Eduardo Orive Vinuesa — Tue, 18 Aug 2020 12:25:50 +0000

Updated: Aug 19th, Found a solution that, however manual it's pretty clean and doesn't require adding new dependencies.

Why?

Recently I was asked to run a small web to hub the contents of a poetry event. Wordpress or Strapi were my first options but I don't feel confident with PHP to fully customize wordpress and I had no practice with Strapi at all.

I have ran some test projects with Preact and it's CLI (https://github.com/preactjs/preact-cli/) makes it pretty easy to start a SPA.

What?

Given we have done an SPA capable of fetch Wordpress posts from it's API, and categories and all that; we still will have to manage with deployment and issues like CORS.

The obvious solution is to use your SPA as a Wordpress Theme.

How to do it myself?

Imagine that our theme formal name is preact-spa. We will store the output into the folder wp-theme.

Then, step by step:

Create a preact-wp.config.js with this content:

import previous from './preact.config.js';

export default function (config, env, helpers) {
    config.output.publicPath = '/wp-content/themes/preact-spa/';
    previous(config, env, helpers);
}

Now we have to build it:
```
yarn build -c preact-wp.config.js --dest wp-theme
```
you can also run npm run build ... if not using yarn.
Copy or rename wp-theme/index.html as wp-theme/index.php.

If you are using css urls you may notice that the path to these files is not set to be under wp-content/... a barbarian but practical solution is to install string-replace-loader as a development dependency and expand our preact-wp.config.js

import previous from './preact.config.js';

export default function (config, env, helpers) {
    const publicPath = '/wp-content/themes/nsp/';
    config.output.publicPath = publicPath;
    config.module.rules.push({
        test: /\.css/,
        loader: 'string-replace-loader',
        options: {
          search: /url\('\/assets\/(.*)?'\)/ig, 
          replace: (_match, resource) => `url('${publicPath}assets/${resource}')`,
          flags: 'g',
        }
      });
    previous(config, env, helpers);
}

create a new wp-theme/style.css file:

/*
Theme Name: Preact SPA
Author: Your Name
Author URI: https://github.com/your-github
Description: Create React WP Theme in no time
Version: 0.0.1
License: GPL
License URI: http://www.gnu.org/licenses/gpl-2.0.html
Tags: generated
Text Domain: your-domain

This theme, like WordPress, is licensed under the GPL.
*/

[optional] Consider some cleanup before shipping:
```
rm wp-theme/*map wp-theme/sw-debug.js
```
Zip it to your Wordpress site and switch to this theme.

Issues?

Sure, Creating a theme from running yarn dev so it updates it self as the code changes. However I don't consider it really necessary.

Yes... But?

Questions? Comments? Please comment below I would be happy to help.