How does this compare to something like Dex or Ory?
Sick of spending time on Auth, we built an open source 'Stripe for Auth'
41–50 of 347 posts
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#42Earlier quoted context omitted.
Thank you! I answered a similar comment which it seems like you've seen. Not sure I understood your response on that one. Why was the tone deplorable?
I think you confused the threads :)
Oops, yes I did - haha.
But I hope it answered your question?
Also, when you say innovation is neccessary - what makes you say that? In the sense that do you have any specific pain points or innovation in mind?
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#43Interesting idea! I did a quick look through your site and have a few issues: 1. What MFA methods do you support? TOTP? App based auth? U2F? FIDO2? (FIDO2 USB? BLE? Platform authenticators?) Smart cards (especially for enterprise)? Backup OTP's? New device detection? 2. Your docs mention not playing nice with password manager autofill by default. Are there plans to address this? 3. Password reset emails come from @su…
I second this! Please prioritize TOTP / U2F over social logins.
I might be off base here, but does anyone really leverage social logins anymore? Seems like it's the worst case scenario for auth in the case that a customer can no longer access the associated social account? Basically in every case you'd have to provide an antiquated flow for them to "re" sign-up with an email. I'm genuinely curious of the value add here, outside of using Sign In With Apple (since it parlays nicely into Apple Pay integrations).
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#44Sounds like this may pair with something like OSO for Python (osohq.com), thanks! Do you plan to directly support language specific client libraries or are you looking for community support of that work?
Yea! Integrations with OSO makes sense! We do have plans to support language specific client libraries.
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#45feedback after 30s of looking into this - i'm not understanding what this is without email verification and social login
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#46For anyone else wondering: the frontend depends on NodeJS and the backend is Java. Ooof.
What's wrong
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#47Thank you for working on such a horrible problem for developers. Looks amazing tbh. Will definitely try this out on a future project. Edit: open source part = huge. Great work
Thank you for your kind words - its really encouraging! Please do let us know when you are trying it out, we'd be happy to help and hear your feedback. You can join our discord (https://supertokens.io/discord) or email me at advait at supertokens [dot] io
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#48Authentication is a solved problem; authorization is not. External authentication makes your system brittle, so I'm glad to see you can self-host SuperTokens for free. I've been working on Enterprise Access Control (EACL) in my spare time, an embedded Datalog-based library with a uniform declarative Clojure API that lets you write grant/deny ACL rules in the shape: Who, What, Why, When, Where & How that goes a little…
Cue Zed Shaw and "The ACL Is Dead"...
I once worked on a project for flexible authorization called "SecureKit" which attempted to be a common criteria evaluated system for any kind of authorization. It quickly became apparent that it would pretty much have to be Turing complete to satisfy the general case.
For example, some systems anyone can authenticate when a fire is occurring in some other areas, but normally only a certain set of people can have access to it.
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#49I'm just in the process of setting up our Auth system now with cognito. It sure is painful! Looks like you guys have everything I need except social login.
Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'
#50This is an idea that I briefly pursued for the same reasons you list, namely that it's a ubiquitous problem which needs to be solved repeatedly.
But in a rough design sketch as to how I would create a generic solution, I made the auth service a proxy for the main app. So user data would be verified and decoded in the proxy, and the app could trust the passed token. This removes the need for a back end driver.
I'm curious about why you didn't choose this approach, and instead made the auth service callable from the app?