jigar-sable / instagram-mern

Full-Stack Instgram Clone using MERN Stack and Socket.io

Instagram MERN

Full-Stack Instgram Clone using MERN Stack and Socket.io

Visit Now 🚀

🖥️ Tech Stack

Frontend:

         

Backend:

       

Realtime Communication:

Cloud Storage:

Deployed On:

Cloud Storage: Cloudinary Mail Service: Sendgrid

🚀 Features

• Login/Signup User Account
• Login using Email/Username
• Update Profile/Password User Account
• Reset Password Mail using Sendgrid
• Infinite Scroll Posts
• Suggested Users
• Search User Accounts by Name/Username
• Follow/Unfollow Users
• Like/Unlike Posts (Double Tap Like)
• Comment on Post
• Save/Unsave Post
• Visit User Profiles
• Share New Post
• Skeleton Loaders
• Delete Own Posts
• Search Users to Chat
• Add New Chat
• Message Users
• Typing | Online User Status
• See Followers/Following of Users
• Post Liked by Users
• Emoji Enabled (Emoji Mart)

Branch dev-v3-cloudinary uses Cloudinary to store images.

Branch dev-v2-aws uses AWS S3 to store images.

Branch dev-v1 uses local storage.

Sneak Peek of Home Page 🙈 :

📬 Contact

If you want to contact me, you can reach me through below handles.

© 2022 Jigar Sable

instagram-mern's Issues

Instegram

Auth implementation is not secure.

I don't believe that this system is very secure, as:

• There is no way to invalidate tokens.
• On logout, the user is simply passed an expired token.
• This means that a bad actor could easily use the old token to access the account.
• Only safeguard is sending the token as an httpOnly cookie, which merely prevents scripts from accessing the token on supported browsers.

In general, JWTs should have short times to expiry unless they can be revoked (such as by using a whitelist/blacklist on server).

Decreasing the JWTs time to live will only decrease user satisfaction by requiring more frequent re-logins.

The best way to solve the issue (in my opinion) would be to save some kind of session-based approach. This will reduce the scalability of the app, though this could be improved by implementing a dedicated auth server or by using a 3rd party authentication provider.

Not sure whether this is in the scope of the project, but I wanted to get these concerns out there just in case anyone is considering using this auth scheme in their own projects.

Hosted link does not work

Link not working

Your provided heroku link of this web application is not working. It is showing "Deceptive site ahead".