41–50 of 141 posts
Auth isnt hard, built lots of auth systems. Crypto is the thing I won't touch with a ten foot pole.
[1]: https://owasp.org/Top10/A01_2021-Broken_Access_Control/
In addition, they have easy means of customizing the User object, querying external data sources, etc. Highly recommend.
Personally, I am torn.
As a developer, magic links are awesome. You put a new project online, and everyone on planet earth already is a user. Well everyone who has an email.
But from a user perspective, it is more cumbersome. For one because the switch between email and website. And because the typical magic link implementation invalidates the link after one use. So if I don't keep the cookie, I have to do the "enter email, receive email, click link" dance again. Entering my email and a password is faster.
I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…
From a user perspective, how does everyone here feel about magic links vs email and password? Personally, I am torn. As a developer, magic links are awesome. You put a new project online, and everyone on planet earth already is a user. Well everyone who has an email. But from a user perspective, it is more cumbersome. For one because the switch between email and website. And because the typical magic link implementat…
Email is unreliable, there's typos, people not knowing their email address, etc. Meanwhile with SSO, two clicks and it logs you into the site with the email you're logged in with.
We've rolled our own (zero frills) so far, but are looking at PropelAuth ( https://www.propelauth.com/ ) to add MFA and other bells and whistles and we like what we see. (Full disclosure, they've become friends of ours through YC)
Auth is actually a combination of two things: authentication and authorization.
Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team)
There are many providers for each. Authentication is about the user's identity and where they belong in the organization (directory), and authorization is about what they are allowed to do based on their identity, role, and attributes.
Cerbos[0] is an open-source authorization solution which integrates with many identity providers to enable your product to implement fine grained permissions. We have integrated with the most popular authentication providers and they can be found on our ecosystem page[1]
Cerbos also has an out-of-the-box integration with Prisma[2] which enables you to fetch only those records that the user has permissions to from your data store - one of the most tricky parts of implementing authorization.
Whatever solution you end up going with, please save yourself some time and do not re-invent the wheel!
[0]: https://cerbos.dev [1]: https://cerbos.dev/ecosystem [2]: https://cerbos.dev/blog/fully-featured-authorization-for-you...
Disclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity and…