Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use to build auth?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 141 posts

Re: Ask HN: What do you use to build auth?

#81

Post by emreb »

s1k3s wrote: post #74
emreb wrote: post #49

Disclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity and…

How does this compare to Keycloak?

Keycloak handles both authentication and authorization and they are tightly coupled. Cerbos solely focuses on authorization and is capable of integrating with any authentication method that is already existing in your application.

Re: Ask HN: What do you use to build auth?

#83

Post by irrelevelephant »

I built a Next.js library for this purpose using Hellō and iron-session. This lets me roll a new application with social login without needing to register with Google/Apple/other providers.

https://github.com/irrelevelephant/nextjs-hello

Its interface is essentially just a login button component, and functions to retrieve the user session state on both the client/server.

If you're not using Next.js, you may want to use Hellō directly - it's a simple OIDC provider with some convenient benefits.

https://www.hello.dev/

Re: Ask HN: What do you use to build auth?

#84

Post by spapas82 »

Django auth only for projects that have their users in the database.

Django-auth-ldap with python-ldap when I need to use ldap.

Django-allauth when I need oauth providers (google github etc)

Requests-oauthlib integrated with django auth when I need a more customized solution.

I've never understood the reason to use anything else ...

Re: Ask HN: What do you use to build auth?

#86

Post by likortera »

jaeming wrote: post #19

I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…

Recommending people that don't know how to/if to do it (that's why they are asking) to write their own auth, trivializing the problem and in the same comment recommending using JWT terrifies me quite a lot.

Re: Ask HN: What do you use to build auth?

#87

Post by dickhardt »

Your question is missing a couple key inputs. Q: Is your SaaS app targeting enterprise use cases, where the customer will want to enable SSO and centralized provisioning? Keybase is a reasonable choice in this case because of the SAML and SCIM support. Q: What is your expected revenue per user? Auth0 solves many problems out of the box, but is priced on MAU which can be prohibitive if your revenue per user is low, but deals with lots of complicated issues if not and lets you focus on building your app.

I'm the founder of Hellō[0], and if you are targeting consumers or individual professionals and want to give them choice, check it out.

As some background, I cofounded the OpenID Foundation, drove creation of OAuth 2.0 and what became JWT, and gave a popular Identity 2.0[1] talk years ago.

[0] https://hello.coop & https://hello.dev [1] https://www.youtube.com/watch?v=RrpajcAgR1E

Re: Ask HN: What do you use to build auth?

#88

Post by dickhardt »

jaeming wrote: post #19

I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…

The identity federation protocol flows are pretty straight forward (I may be biased!) ... but you should use existing libraries for all the crypto.

Defeating credential stuffing attacks is HARD. That is where services such as Auth0 shine.

Re: Ask HN: What do you use to build auth?

#89

Post by joshxyz »

dickhardt wrote: post #87

Your question is missing a couple key inputs. Q: Is your SaaS app targeting enterprise use cases, where the customer will want to enable SSO and centralized provisioning? Keybase is a reasonable choice in this case because of the SAML and SCIM support. Q: What is your expected revenue per user? Auth0 solves many problems out of the box, but is priced on MAU which can be prohibitive if your revenue per user is low, bu…

I think you meant KeyCloak not Keybase? haha.

Re: Ask HN: What do you use to build auth?

#90

Post by joshxyz »

mohitsingh wrote: post #60

Well, I wrote one with rust and actix-web for exact same purpose. In my opinion, writing basic auth is simple and safe if you keep OWASP guidelines and other best practices in mind but adding features like SSO and MFA etc is complicated. With that said, almost everything else I tried feels so heavy and slow that I'm sticking with mine for now. If I've to use prebuilt solutions, I'll pick one that is open source and c…

Seconding this.

Basic auth is easy.

The hardest parts are OAuth, SSO, MFA, OWASP Security, tracking metrics correctly. Good lord.

Post reply on HN