Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use to build auth?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 141 posts

Re: Ask HN: What do you use to build auth?

#71

Post by waspight »

candiddevmike wrote: post #26
jaeming wrote: post #19

I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…

Devs should never default to using JWTs IMO, I think that is leading folks to delegate auth to providers as it overly complicates the process. There's nothing wrong with stateful API keys/session tokens, and I would wager the majority of web services still use them.

Jwt is a much easier term to google for information than the api key/session solution you mention. I actually default to jwt just because I don’t have a clear picture of what the alternative is called.

Re: Ask HN: What do you use to build auth?

#72

Post by mdtusz »

davedx wrote: post #16

> People keep telling me that writing auth myself is a bad idea, and creating truly secure auth is really hard. Yes the problem these days is a lot of commercial providers want this to become "common knowledge" and for it to be "best practice" to use their systems. But what happens if Okta has a data breach and you don't even know if your users were affected? (This happened) I strongly believe in rolling your own aut…

I'd also argue that adding MFA with TOTP really isn't _that_ hard either. There's a bit of setup work to be sure, but it's a feature just like any other that has a pretty easy to grasp flow once you do a bit of reading.

Don't do your own cryptography (just use bcrypt or if you're confident you won't mess it up, libsodium), but authN/Z is entirely within the realm of "roll-your-own" and should be table stakes for most businesses these days.

Even adding SAML or OIDC support really isn't that hard.

Re: Ask HN: What do you use to build auth?

#73

Post by freeqaz »

keraf wrote: post #17

For small JS projects, I use Passport[0] as it is quite simple to implement and has ton of examples (including how to use it with Next). For bigger projects where I need a full-fledged and reliable solution out of the box, I use Ory[1]. [0] http://www.passportjs.org/ [1] https://www.ory.sh/

I'm actually on the inverse side of this now:

I find Passport to be a dumpster fire of complexity and foot guns while Ory Kratos[0] + Ory Oathkeeper[1] have been the simplest way to add Auth to a project now (even for an MVP).

I've been using the zero trust proxy tutorial[2] and copy pasting the configs over. I just chuck some containers into Docker Compose and it goes. I don't even have to write the UI because Kratos does that but.

0: https://www.ory.sh/docs/kratos

1: https://www.ory.sh/docs/oathkeeper

2: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...

Re: Ask HN: What do you use to build auth?

#74

Post by s1k3s »

emreb wrote: post #49

Disclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity and…

How does this compare to Keycloak?

Re: Ask HN: What do you use to build auth?

#75

Post by tppiotrowski »

quaffapint wrote: post #24
upupandup wrote: post #12

Earlier quoted context omitted.

Absolutely recommend against using AWS Cognito. It is a nightmare to use. Currently I am trying to integrate Firebase into AWS because of how bad Cognito is. One thing going well that Cognito will never be is Firebase Auth.

What made it a nightmare to use? We're just about finished migrating to Cognito (using our own UI) and it's been the same experience as working with Auth0 but much cheaper. The only goofy part was in order to have a custom password reset email you need to put it in a lambda.

Attributes. There are standard attributes like email, phone_number, name, address. Then there are up to 50 custom attributes you can define which need a min/max length and can be of number or string type. You can't remove or change them after you define them. As you user metadata grows this can be insufficient and inflexible causing you to store user data set in another place like a DB. Now your user data is fragmented. Part of it is Cognito and part of it is in the DB. This leads to complexity and performance hits when querying data and consistency issues when updating data. I would avoid using Cognito attributes at all costs and use a DB table for user metadata instead.

Re: Ask HN: What do you use to build auth?

#76

Post by freeqaz »

rusticpenn wrote: post #70

I am surprised that I did not find keycloak here…

For small projects, Keycloak is wayyyy too heavy for them. It requires multiple domains which makes sign outs hard... a OIDC server and client... it's a lot.

It works well when you need to stitch together multiple services but otherwise it's not something I'd use for an MVP. (And even then you can wrap Auth with nested subdomains and a top level cookie w/ a proxy to pass headers to each service. Easier and less complexity because state lives in one place.)

Re: Ask HN: What do you use to build auth?

#77

Post by vonadz »

emreb wrote: post #65
shantnutiwari wrote: post #54

Earlier quoted context omitted.

Just went to the cerbos.dev site-- there is a cookie banner that says you serve targeted ads, and asks me to "accept all". No option to reject tracking/ad cookies. At this point, why even have the banner? Real As*hole design

Sorry about that and thank you for bringing it to our attention. As you might imagine we spend a lot of time on that site and did not notice the option to reject is not available. We will action this very soon.

Sounds like you should be using a service for it.

Re: Ask HN: What do you use to build auth?

#79

Post by tppiotrowski »

dewey wrote: post #25
jaeming wrote: post #19

I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…

> Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. You are presenting an extremely limited scope. What you get from using an authentication provider is things like verifying email addresses, OAuth where you just have to "enable" Google, Github, Apple login possibilities. Implementing all these flows yourself is a lot more than 10 lines of code. Then you also have to do password rese…

Also two-factor auth via email/SMS codes

Re: Ask HN: What do you use to build auth?

#80

Post by gedy »

frankthedog wrote: post #66
gedy wrote: post #23

Not exactly your question, but since you are using NextJS I highly recommend you use its API route[0] support to proxy your backend API calls, which allows you to avoid exposing auth tokens, etc to client web front end [0] https://nextjs.org/docs/api-routes/introduction

If the front end isn’t sending an Auth token back then the front end isn’t logged in. How do you propose making authenticated calls from the client?

Next handles the session, I mean exposing one or more OAuth/JWT for backend services.
Post reply on HN