Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-Source Auth for NextJS / React

ory.dev

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Show HN: Open-Source Auth for NextJS / React

#21

Post by claystraw »

p2hari wrote: post #16
claystraw wrote: post #7

Earlier quoted context omitted.

I have not used NextAuth, so take my analysis with caution. As far as I can tell, NextAuth is similar to Passport.js as it offers many adapters to sign in with different providers (e.g. Twitch or Pipedrive). It is not an identity system though, so it does not have things like "update your profile info" or "link Google to this account". I think this manifests with missing password authentication. Even though that's no…

I think the part on DB adapters is right in the sense that NextAuth allows us to use whichever db persistence we need. But if that is handled by Ory. what Db does Ory use? Should we set up our own.? Also, authentication and authorization are core for an app. If we do authentication here, how does authorization work? Can I bring my own authorization like oso etc.

With great power comes great responsibility :) Having the flexibility to build persistence yourself is great, it comes at the cost and responsibility of continuously maintaining it! We have run into so, so many edge cases. Here are some examples:

1. What do you do when a user with email "foo@example.org" has already signed up, and now is trying to sign up using Google with "foo@example.org"?

2. How do you ensure that a user can update sensitive information (e.g. their recovery email address, or linking additional "Sign in with" providers) while keeping a balance between security and user experience?

3. What if you now want to add biometric auth for native mobile apps, or 2FA?

The complexity in building your own is not starting with the first 10%. As your app and business grows, teams are faced with ever increasing requirements. Leaning on an established open source provider built by experts in the area just saves you so much time, headaches, and potential security oversights!

> What Db does Ory use? Should we set up our own.?

We support all prominent SQL systems - so PostgreSQL, MySQL, CockroachDB, SQLite, ... - and of course all cloud SQL vendors. You can also choose to run Ory in Ory Cloud, then we take care of all of this for you!

> Also, authentication and authorization are core for an app. If we do authentication here, how does authorization work? Can I bring my own authorization like oso etc.

Absolutely! We have a project for this also: https://github.com/ory/keto

Hope this clarifies your questions!

Re: Show HN: Open-Source Auth for NextJS / React

#22

Post by claystraw »

chwzr wrote: post #15
claystraw wrote: post #14

Earlier quoted context omitted.

Yes absolutely, you can use the Ory SDK's `toSession()` function to resolve a Session Cookie (for browsers) or Session Token (for non-browsers, e.g. native mobile apps) to its identity. We have on the list to add a section about using Next's new middleware feature to protect API routes. Is that something you'd be interested in?

yes having the identity on hand by just looking up req.identity would be super neat feature!

Nice, we'll add a guide shortly. This is already possible but we just didn't have time yet to add it to the guide :) If you want, create an issue in the GH (https://github.com/ory/kratos-nextjs-react-example/issues/ne...) repo for this so you get notified once it's available, and so we don't forget!

Re: Show HN: Open-Source Auth for NextJS / React

#23

Post by dotancohen »

claystraw wrote: post #3

Hello, one of the maintainers of https://github.com/ory/kratos (the system used in the blog post) here :) We started Ory Kratos because we saw so many developers struggle with OAuth2 and OpenID Connect. If you have any questions around application auth, OAuth2, or Go, open source I'll try to do my best to answer them accurately!

Another top-level comment mused:

  > I found it hard to quickly determine whether Kratos can run completely
  > self-hosted, or that there's always some connection to Ory / Ory Cloud services.
I would appreciate answering that at the proper comment, I'm sure many readers here are very interested in the privacy aspect:

https://news.ycombinator.com/item?id=29330048

Re: Show HN: Open-Source Auth for NextJS / React

#24

Post by Sytten »

claystraw wrote: post #11
rapnie wrote: post #10

I found it hard to quickly determine whether Kratos can run completely self-hosted, or that there's always some connection to Ory / Ory Cloud services.

Both! :) Ory Cloud is still in it's early phases and we have not been very good at communicating it well. Basically, we run Ory Kratos in Ory Cloud and it has full API and configuration and data compatibility with the version that is on GitHub! Our goal is to also allow users to easily switch from self-hosted to ory cloud and back - but it's still a bit of work until we get there. If you just want to check our Ory Kr…

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in case of shared machines) or per machine (in case of dedicated instances).

Re: Show HN: Open-Source Auth for NextJS / React

#25

Post by claystraw »

Sytten wrote: post #24
claystraw wrote: post #11

Earlier quoted context omitted.

Both! :) Ory Cloud is still in it's early phases and we have not been very good at communicating it well. Basically, we run Ory Kratos in Ory Cloud and it has full API and configuration and data compatibility with the version that is on GitHub! Our goal is to also allow users to easily switch from self-hosted to ory cloud and back - but it's still a bit of work until we get there. If you just want to check our Ory Kr…

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in c…

Thank you Sytten, this comment makes me happy because it confirms our bias! MAU pricing has always been my personal enemy. Ory is and never will charge on a MAU basis. Instead, we'll be working with CPU, Memory, and Disk usage (like any other cloud provider) and with additional services on top. We're not fully there yet to communicate this clearly, but if you're interested check out the pricing page to understand where we want to land at: https://ory.dev/pricing/

Re: Show HN: Open-Source Auth for NextJS / React

#26

Post by claystraw »

littlecranky67 wrote: post #20
claystraw wrote: post #7

Earlier quoted context omitted.

I have not used NextAuth, so take my analysis with caution. As far as I can tell, NextAuth is similar to Passport.js as it offers many adapters to sign in with different providers (e.g. Twitch or Pipedrive). It is not an identity system though, so it does not have things like "update your profile info" or "link Google to this account". I think this manifests with missing password authentication. Even though that's no…

NextAuth has the credentials provider to allow username/password logins [0] - I use it in a project and it works okay-ish. However I too got a weird feeling when I read what the NextAuth team really thinks about a username/password login: > The functionality provided for credentials based authentication is intentionally limited to discourage use of passwords due to the inherent security risks associated with them and…

Ah, thank you for the clarification and I agree! Another point is that 3rd party tools can easily deactivate profiles (we've seen enough posts on HN about being locked out of a Google account) which means users loose access to your system unless you have fallbacks in place.

It's also important to note that almost no 3rd party providers offer the ability to require 2FA as part of their flows. So if you need 2FA and similar, you'll end up with your own system again. And you'll probably use passwords, because proving that you own two things - eg email and device - is not a second factor. If someone steals your laptop (something you no longer own :D ) it's just one factor!

Re: Show HN: Open-Source Auth for NextJS / React

#27

Post by bsid »

claystraw wrote: post #25
Sytten wrote: post #24

Earlier quoted context omitted.

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in c…

Thank you Sytten, this comment makes me happy because it confirms our bias! MAU pricing has always been my personal enemy. Ory is and never will charge on a MAU basis. Instead, we'll be working with CPU, Memory, and Disk usage (like any other cloud provider) and with additional services on top. We're not fully there yet to communicate this clearly, but if you're interested check out the pricing page to understand whe…

MAU pricing is terrible! love this idea.

Heads up, I don't quite get this from your pricing page at all right now.. It says "First 900 free" and "First 100 free" without any indication of what those numbers mean.

Re: Show HN: Open-Source Auth for NextJS / React

#28

Post by claystraw »

bsid wrote: post #27
claystraw wrote: post #25

Earlier quoted context omitted.

Thank you Sytten, this comment makes me happy because it confirms our bias! MAU pricing has always been my personal enemy. Ory is and never will charge on a MAU basis. Instead, we'll be working with CPU, Memory, and Disk usage (like any other cloud provider) and with additional services on top. We're not fully there yet to communicate this clearly, but if you're interested check out the pricing page to understand whe…

MAU pricing is terrible! love this idea. Heads up, I don't quite get this from your pricing page at all right now.. It says "First 900 free" and "First 100 free" without any indication of what those numbers mean.

Clerk (your profile says you're CTO) has a per-user pricing though? Or are you planning on changing it?

> It says "First 900 free" and "First 100 free" without any indication of what those numbers mean.

Thank you, we'll clarify that! It means that we're giving the first 900 "start up" and 100 "growth" plans away for free for a year

Re: Show HN: Open-Source Auth for NextJS / React

#29

Post by mooreds »

mjepronk wrote: post #8
claystraw wrote: post #3

Hello, one of the maintainers of https://github.com/ory/kratos (the system used in the blog post) here :) We started Ory Kratos because we saw so many developers struggle with OAuth2 and OpenID Connect. If you have any questions around application auth, OAuth2, or Go, open source I'll try to do my best to answer them accurately!

Thank you for working on this interesting open source product. I have some questions: - Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations? - Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)? - Do you support SAML 2.0 cli…

> - Do you support SAML 2.0 clients?

There be dragons.

(Disclosure: I work for FusionAuth.)

Funny story. We had a client doing a SAML integration using HTTP-redirect bindings. It worked when you turned off request signature verification (which is fine for testing, but is like using alg="none" for JWTs, a non-starter in production), but failed when that was turned on. We dug in with the client and another vendor, set up some test servers, and identified the bug[0]. Turns out that you can't canonicalize the signature's URL encoded form, because both uppercase and lowercase hex values are allowed, by the SAML spec.

Our open source SAML library[1] has been around for years and used by many clients in FusionAuth and our other projects. It'd never run into this particular edge case. It is a wild west out there in SAML land and it takes years to build a bulletproof implementation. Ory folks, if you can leverage an existing implementation rather than rolling your own, I'd highly advise that approach.

That is also to say nothing of the incoming privacy/cookie limitation changes that are coming in the next few years. This will unfortunately probably negatively affect SAML, which is not a specification that has evolved much. If this is of interest to you, I'd recommend the Federated Identity W3C community group[2].

That said, FusionAuth supports SAML in many forms[3]. SAML support varies across vendors and implementations, but other providers like Keycloak and IdentityServer do so as well.

0: https://github.com/FusionAuth/fusionauth-issues/issues/1496

1: https://github.com/FusionAuth/fusionauth-samlv2

2: https://www.w3.org/community/fed-id/

3: https://fusionauth.io/docs/v1/tech/core-concepts/integration...

Re: Show HN: Open-Source Auth for NextJS / React

#30

Post by claystraw »

dotancohen wrote: post #23
claystraw wrote: post #3

Hello, one of the maintainers of https://github.com/ory/kratos (the system used in the blog post) here :) We started Ory Kratos because we saw so many developers struggle with OAuth2 and OpenID Connect. If you have any questions around application auth, OAuth2, or Go, open source I'll try to do my best to answer them accurately!

Another top-level comment mused: > I found it hard to quickly determine whether Kratos can run completely > self-hosted, or that there's always some connection to Ory / Ory Cloud services. I would appreciate answering that at the proper comment, I'm sure many readers here are very interested in the privacy aspect: https://news.ycombinator.com/item?id=29330048

Does https://news.ycombinator.com/item?id=29330103 answer your questions or can I clarify further? :)
Post reply on HN