# Clojure web app security
**URL:** https://clojureverse.org/t/clojure-web-app-security/7283
**Category:** How to?
**Tags:** clojure, clojurescript
**Created:** [March 1, 2021, 11:39pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283 "2021-03-01T23:39:05Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@alanforr](https://clojureverse.org/u/alanforr)
#### Post date: [March 1, 2021, 11:39pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/1 "2021-03-01T23:39:05Z")
Is there a canonical library or set of libraries that are used for security for Clojure web apps that would solve the same sort of problems that would be solved by using Devise with Ruby on Rails?
---
### Author:  [@seancorfield](https://clojureverse.org/u/seancorfield)
#### Post date: [March 2, 2021, 6:11am UTC](https://clojureverse.org/t/clojure-web-app-security/7283/2 "2021-03-02T06:11:06Z")
I believe the two most popular libraries are:
- [cemerick/friend: An extensible authentication and authorization library for Clojure Ring web applications and services. (github.com)](https://github.com/cemerick/friend)
- [funcool/buddy: Security library for Clojure (github.com)](https://github.com/funcool/buddy)
Neither has been updated for about four years – because they are considered stable.
---
### Author:  [@SteffanWestcott](https://clojureverse.org/u/SteffanWestcott)
#### Post date: [March 2, 2021, 11:47am UTC](https://clojureverse.org/t/clojure-web-app-security/7283/3 "2021-03-02T11:47:11Z")
I believe the maintained version of `friend` is now [clj-commons/friend](https://github.com/clj-commons/friend)
---
### Author:  [@seancorfield](https://clojureverse.org/u/seancorfield)
#### Post date: [March 2, 2021, 4:55pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/4 "2021-03-02T16:55:10Z")
Yes, I should have checked there. I’m a bit surprised that Chas’s version doesn’t point to the clj-commons version. It certainly is a bit confusing that the README on Chas’s version says:
> Note: while actively maintained, [Friend is in search of a new maintainer](https://groups.google.com/forum/#!topic/clojure-sec/ceMhYPR0G60).
and the README on the clj-commons version says:
> This library is in maintenance mode. That means that it’s no longer actively developed, but we still provide maintenance. If you’re looking for an actively developed authentication lib, please consider using [buddy](https://github.com/funcool/buddy)
and then when you go to Buddy, you find it hasn’t been updated in nearly four years!
---
### Author:  [@John\_Shaffer](https://clojureverse.org/u/John_Shaffer)
#### Post date: [March 2, 2021, 7:02pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/5 "2021-03-02T19:02:35Z")
> and then when you go to Buddy, you find it hasn’t been updated in nearly four years!
That’s just the `buddy/buddy` artifact. The modules have been updated recently: [buddy-hashers](https://github.com/funcool/buddy-hashers) and [buddy-sign](https://github.com/funcool/buddy-sign) were updated in December.
---
### Author:  [@Kah0ona](https://clojureverse.org/u/Kah0ona)
#### Post date: [March 2, 2021, 7:12pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/6 "2021-03-02T19:12:46Z")
While a few years old, [this article](https://rundis.github.io/blog/2015/buddy_auth_part1.html) gives some decent pointers.
Could be used as inspiration, as it shows things like session storage, hashing, and how to put the pieces together.
---
### Author:  [@seancorfield](https://clojureverse.org/u/seancorfield)
#### Post date: [March 2, 2021, 7:17pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/7 "2021-03-02T19:17:30Z")
Oh, totally missed that! All that (very important) information is in the README but buried below the fold so at a quick glance, it just looks abandoned.
---
### Author:  [@didibus](https://clojureverse.org/u/didibus)
#### Post date: [March 3, 2021, 6:33am UTC](https://clojureverse.org/t/clojure-web-app-security/7283/8 "2021-03-03T06:33:17Z")
Has anyone tried Apache Shiro with Clojure?
[https://shiro.apache.org/](https://shiro.apache.org/)
It seems it shouldn’t be too hard to integrate.
---
### Author:  [@crispinb](https://clojureverse.org/u/crispinb)
#### Post date: [March 3, 2021, 7:53am UTC](https://clojureverse.org/t/clojure-web-app-security/7283/9 "2021-03-03T07:53:33Z")
There is at least one wrapper library: [GitHub - inventi/Pocheshiro: Clojure wrapper for Apache Shiro](https://github.com/inventi/Pocheshiro).
I haven’t used it (or Apache Shiro). Not updated for years, which may or may not matter.
---
### Author:  [@system](https://clojureverse.org/u/system)
#### Post date: [September 1, 2021, 7:54pm UTC](https://clojureverse.org/t/clojure-web-app-security/7283/10 "2021-09-01T19:54:08Z")
This topic was automatically closed 182 days after the last reply. New replies are no longer allowed.