Auth isnt hard, built lots of auth systems.
Crypto is the thing I won't touch with a ten foot pole.
Ask HN: What do you use to build auth?
31–40 of 141 posts
Re: Ask HN: What do you use to build auth?
#32We've rolled our own (zero frills) so far, but are looking at PropelAuth (https://www.propelauth.com/) to add MFA and other bells and whistles and we like what we see. (Full disclosure, they've become friends of ours through YC)
Re: Ask HN: What do you use to build auth?
#33next-auth has been the best I've ever used.
Re: Ask HN: What do you use to build auth?
#34I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…
Having your own password table even feels archaic today. From what I've seen, even simple internal apps are doing SSO with a directory provider (Google, AD/ADB2C, Okta, etc.)
Re: Ask HN: What do you use to build auth?
#35If you are going to implement yourself I would recommend familiarizing yourself with the NIST SP 800-63b [0] guidelines.
Have a good understanding of cryptographic primitives and what the state of the art is right now for hashing, salting; both at rest and in-transit, etc.
And make sure you follow the principles of least privilege.
Of course this is a fair bit of work and there are specialists in the industry who've made authentication into a service which takes care of following the guidelines and best practices... if you know how to vet them.
They don't always get it right either. Standards and practices evolve. Authentication (and its sibling authorization) require keeping up to date and being vigilant.
[0] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Re: Ask HN: What do you use to build auth?
#36I sleep better at night thanks to Spring Security and KISS. [1]
Reading the docs from top to bottom, and diving into the source code makes me believe that "you should never roll your own auth" should be an addendum to "you should never roll your own crypto". The number of edge cases and gotchas is simply mind-boggling. It's not about being a good enough programmer to cover yourself, but about years of collective experience dealing with all sorts of exploits and browser shenanigans.
[1] https://docs.spring.io/spring-security/reference/servlet/aut...
Re: Ask HN: What do you use to build auth?
#37If I want to put something together fast I use the default AWS Cognito and Firebase Auth widgets. I think Firebase Auth has more third party sign in options. In my current project I do away with accounts completely and just email a link that sets a cookie for 30 or 90 days [1]. I think the Auth you choose highly depends on the money/privacy/sensitivity/fraud potential of your project. [1] https://tedpiotrowski.svbtle…
Absolutely recommend against using AWS Cognito. It is a nightmare to use. Currently I am trying to integrate Firebase into AWS because of how bad Cognito is. One thing going well that Cognito will never be is Firebase Auth.
I wish it was easier to use Firebase Auth without the half-maintained javascript mess that is firebase-ui, which has not worked with the current Firebase SDK for, over a year now? (or at least I still failed transitioning from SDK 8 to SDK 9 as of a couple of months ago).
Re: Ask HN: What do you use to build auth?
#38We use identity server from M$ its fairly good and works for our purposes, its easy to bind clients etc. we can always expand it if we want it to do more.
Re: Ask HN: What do you use to build auth?
#39I have used AWS Cognito and Azure AD B2C
Re: Ask HN: What do you use to build auth?
#40Implementing simple auth is not that hard, with JWTs. But you need to use a service anyway for mail (confirm password, reset password etc.), so in the end it's not worth. These days I use Supabase auth and it works.