A lot of my side projects are only visible over a VPN. I have no auth for them as it is not needed.
Ah interesting! I've been experimenting a similar setup.
How do you manage peers and configs?
Ask HN: What type of Auth are you using on your side projects?
31–40 of 72 posts
Re: Ask HN: What type of Auth are you using on your side projects?
#32Keycloak or auth0. The app should support oauth2, if it does not it gets traefik-forward-auth (or whatever it’s called) to enforce mfa then you are in.
There are tons of open source projects to complete the self service experience, from sign up systems to self service password resets
Re: Ask HN: What type of Auth are you using on your side projects?
#33This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…
I personally just really don't like magic links auth. It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse). If you have an issue with bots on your platform you're going to always have bot problems. It's trivial to abuse…
For some prior art, Okta avoids the email link scanning issue by requiring "same browser, same device" (sessions) [1]. An OTP code is included in the email as a fallback for users receiving mail on a different device than they're trying to log in to.
[1]: https://developer.okta.com/docs/guides/email-magic-links-ove...
Re: Ask HN: What type of Auth are you using on your side projects?
#34This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…
I personally just really don't like magic links auth. It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse). If you have an issue with bots on your platform you're going to always have bot problems. It's trivial to abuse…
[deleted]
Re: Ask HN: What type of Auth are you using on your side projects?
#35Appwrite, all in one, and it shockingly just works from install to go focus on building the side projects.
Cheap/ free to self host. I have tried a bunch of the other ones and they all had things I liked but Appwrite gave me nothing to complain about other than getting on with building :)
Re: Ask HN: What type of Auth are you using on your side projects?
#36This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…
I personally just really don't like magic links auth. It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse). If you have an issue with bots on your platform you're going to always have bot problems. It's trivial to abuse…
> if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token
This is what the "change the temporary token for a "permanent" token they (the frontend) can use for authentication" part is for, as it'll require a browser to visit the page so the token can be set in the frontend after making the "switch" with the authentication backend. The tokens get invalidated when used.
Regarding abuse, there is a lot of other things around the design itself that has to be considered that I didn't mention. Rate-limits, validation, verification, operations and other things feel kind of besides the meat of the pattern. Otherwise we'll end up with very long comments :)
Re: Ask HN: What type of Auth are you using on your side projects?
#37Keycloak or auth0. The app should support oauth2, if it does not it gets traefik-forward-auth (or whatever it’s called) to enforce mfa then you are in. There are tons of open source projects to complete the self service experience, from sign up systems to self service password resets
Keycloak has too many new major releases. It is a real pain to keep up with.
Re: Ask HN: What type of Auth are you using on your side projects?
#38I used to use Facebook because it's really easy to work with
Re: Ask HN: What type of Auth are you using on your side projects?
#39I develop an internet forum [0] that uses express-session with a Redis datastore for standard username and password website login. Separately, it also has a JSON API that uses OAuth 2 auth code flow with PKCE [1].
[0] https://github.com/ferg1e/comment-castles
[1] https://www.commentcastles.org/api#api-user-authentication
Re: Ask HN: What type of Auth are you using on your side projects?
#40I’ve been using https://clerk.com. Not needing to build authentication / the UI / … as well as not worrying about hosting it myself has been nice.