Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What type of Auth are you using on your side projects?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 72 posts

Re: Ask HN: What type of Auth are you using on your side projects?

#24

Post by alberth »

diggan wrote: post #20

This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…

More commonly known as “magic links” (login).

Re: Ask HN: What type of Auth are you using on your side projects?

#28

Post by sieabahlpark »

diggan wrote: post #20

This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…

I personally just really don't like magic links auth. It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse).

If you have an issue with bots on your platform you're going to always have bot problems. It's trivial to abuse your auth to derank your standing too. I can force your app to send out bounced emails to hundreds and thousands of bad emails. Costing you $$ or rep in the email exchange. The second affects your ability to authenticate legitimate users too.

Wish magic links would just go away and be acknowledged as an anti-pattern.

Re: Ask HN: What type of Auth are you using on your side projects?

#29

Post by reducesuffering »

mjomaa wrote: post #12

Auth.js! Supported providers: https://authjs.dev/getting-started/providers/github It's been really great so far and I can recommend it if you have a JS/TS codebase. ---------------------------- You can test Auth.js (v5 beta.22) in my Next.js 15 boilerplate: https://achromatic.dev • Credentials auth • Google and Microsoft login • Connected accounts • Multi-factor authentication (via authenticator app) • Session manage…

That's what I'm using too. Along with a very easy integration with Resend for magic link email.
Post reply on HN