11–20 of 234 posts
I'm even hesitant to trust Auth0 for this, why would I trust a new company?
Why would anyone trust a third party with what is the most important asset, their users?
Thank you in advance.
Do you handle teams? Eg for a b2b SaaS?
Since we're tackling both the APIs and the customer-facing UIs, we think we'll be able to add a lot of value here
Hi HN - We couldn't be more excited to launch Clerk and help developers solve all of user management. It's been quite a journey to reach this point, with over a year of iteration on the developer experience before we found something developers love. Using Clerk will enable you to spend more time on your application, and less time worrying about the ever-growing list of user management concerns. Our team is listening…
It's great to see a service focus on taking away all the pain related to user management, not just login.
[1] https://frontend-docs.clerk.dev/react/quick-starts/next.js
Hi HN - We couldn't be more excited to launch Clerk and help developers solve all of user management. It's been quite a journey to reach this point, with over a year of iteration on the developer experience before we found something developers love. Using Clerk will enable you to spend more time on your application, and less time worrying about the ever-growing list of user management concerns. Our team is listening…
Another question, I don't see any mention of security. You are in complete control of our users/profiles and their login credentials and there is zero mention of how secure that data is.
Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next few weeks - but let me try to hit some of the most important points:
* Session management is handled with secure, httpOnly cookies. We have you set a CNAME in production so we can set cookies in a first-party context (SameSite=Lax). * Cookies are scoped only to domains that require authentication data. If your backend is on api.example.com and you're running hosted Wordpress blog on blog.example.com, Wordpress won't receive your session cookies. * Passwords are bcrypted * All frontend-facing endpoints have CSRF protection enabled
Please let us know if there is anything specific we can help clarify. We've gotten into the nitty gritty so there's a lot to document, and it would be great to understand what areas to surface most prominently.
Earlier quoted context omitted.
Another question, I don't see any mention of security. You are in complete control of our users/profiles and their login credentials and there is zero mention of how secure that data is.
Hi dubcanada, Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next few weeks - but let me try to hit some of the most important points: * Session management is handled with secure, httpOnly cookies. We have you set a CNAME in production so we can set cookies in a first-party context (SameSite=Lax). * Cookies are scoped only to…
I'm even hesitant to trust Auth0 for this, why would I trust a new company?
This is my question as well. It's an honest question and hopefully someone can educate me. Why would anyone trust a third party with what is the most important asset, their users? Thank you in advance.
Furthermore, with the economies of scale, there can be more investment done on security & protection of users by a common element. Think of it as a collection of companies pooling their resources on a single engineering team which is responsible for building a rock solid authentication system with many useful features. This helps little guys build on top of something which has the same efficacy as auth services that large companies can afford to build.
At the end of the day, it's a trade off.
Hi HN - We couldn't be more excited to launch Clerk and help developers solve all of user management. It's been quite a journey to reach this point, with over a year of iteration on the developer experience before we found something developers love. Using Clerk will enable you to spend more time on your application, and less time worrying about the ever-growing list of user management concerns. Our team is listening…
@colinclerk, the "Explore documentation" link on the front page is dead.