Selfhosted https://goauthentik.io/
Ask HN: What type of Auth are you using on your side projects?
41–50 of 72 posts
Re: Ask HN: What type of Auth are you using on your side projects?
#42Email+password, jwt tokens. Nothing fancy.
Generally this. There are obvious reasons you might need to use Oauth2/OIDC... but for side projects, I really don't get why people are so opposed to storing a bcrypt or argon hash, and keeping a session table or using a JWT. I can see "never rolling your own auth" if that meant using your own hand-rolled crypto libraries, but somehow it seems to have became "you must pay for a service or use some magic library".
Re: Ask HN: What type of Auth are you using on your side projects?
#43Google, Apple, and Email using PocketBase.
Re: Ask HN: What type of Auth are you using on your side projects?
#44I've been in big tech and out of touch with the real world for a while, and I started a project only a couple of weeks ago to get a feel for what the cool kids are doing in web dev in 2024. So I can't claim any deep authority or experience with a lot of different approaches. But I picked Clerk because it was in a tutorial, and so far so good. It couldn't have been much easier, and the free tier seems more than genero…
Lock in is definitely a valid concern, I emailed customer support and they replied with this:
Certainly understandable to worry about lock-in! We do try and make data exports as easy as possible. You can use our Backend API directly to retrieve all data for your users except for passwords: https://clerk.com/docs/reference/backend-api/tag/Users#opera...
If you need encrypted passwords in the export, you can contact our support team who will verify your account and provide a link from within your Clerk Dashboard to download the complete export directly.
Re: Ask HN: What type of Auth are you using on your side projects?
#45This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots: - Be able to store two types of tokens, one that is temporary, and one that is "permanent" - Users can use their email address to get sent a temporary token (which expires if unused after X minutes) - Users can click that link to change the temporary tok…
I personally just really don't like magic links auth. It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse). If you have an issue with bots on your platform you're going to always have bot problems. It's trivial to abuse…
> if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token
One way you can handle this is to place the token in the hash portion of the url (which doesn't get sent to servers during an HTTP request), and then have JS on the frontend send the token to your backend manually. As long as the email provider isn't scanning links via a headless browser that executes JS, this should work.
I agree with your point about email abuse though (although you still have to prevent bots from abusing email based password resets).
Re: Ask HN: What type of Auth are you using on your side projects?
#46No login required.
Just some ip based rate limits.
Ban misbehaved bot ip addresses.
https://hn.garglet.com (advanced search for hacker news)
Re: Ask HN: What type of Auth are you using on your side projects?
#47Keycloak or auth0. The app should support oauth2, if it does not it gets traefik-forward-auth (or whatever it’s called) to enforce mfa then you are in. There are tons of open source projects to complete the self service experience, from sign up systems to self service password resets
Keycloak has too many new major releases. It is a real pain to keep up with.
Their version numbers are meaningless in that way. Most major up upgrades are non events
Re: Ask HN: What type of Auth are you using on your side projects?
#48no auth at all
Re: Ask HN: What type of Auth are you using on your side projects?
#49I use Traefik with OpenID Connect for everything, and Google as IdP. It's few enough people that I simply add them manually to traefik-forward-auth's settings in Docker Compose.
Re: Ask HN: What type of Auth are you using on your side projects?
#50Keycloak or auth0. The app should support oauth2, if it does not it gets traefik-forward-auth (or whatever it’s called) to enforce mfa then you are in. There are tons of open source projects to complete the self service experience, from sign up systems to self service password resets
Is Keycloak really appropriate for a side-project? Seems quite complex AFAICT.