Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#81

Post by vivzkestrel »

I am building a production grade express API generator that lets people download a full production ready with all tooling setup express API with dependencies like ESLint, Prettier, Husky, Commitlint etc configured. One of the steps lets people choose an authentication provider and I intend to add your library

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#82

Post by vivzkestrel »

maenbalja wrote: post #26

I'm very tempted to make the leap from Lucia to Better Auth for a greenfield project, but the thought of jumping yet again from one auth solution to another is making me hesitate. If there are any satisfied (or unsatisfied) devs who have attempted the Lucia -> Better Auth transition, I'd love to hear your thoughts on this!

Lucia is deprecated https://github.com/lucia-auth/lucia/discussions/1707 so yea i ll jump if I were you

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#83

Post by vivzkestrel »

WorldMaker wrote: post #39

It feels wrong in 2025 that Passkey support isn't up-front and first class and is relegated to a plugin.

nobody i know uses it. Talk with circles outside tech and ask them "how many passkeys they have". They will ask you what is a passkey

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#87

Post by doshaa »

theogravity wrote: post #76
bekacru wrote: post #40

Earlier quoted context omitted.

- Not right now, but there’s already an open issue and a PR in progress. - We don’t use JWTs directly, and sessions always require state (it’s not stateless). And yeah, both the client and server handles automatic session refresh. - Yes, we support both multiple sessions or having different organizations open in different tab: https://www.better-auth.com/docs/plugins/multi-session - Yes, that’s possible, you just nee…

As another asked, "why?" on no JWT? It makes interfacing with our API servers so much easier as we don't need to maintain infra for sessions and wouldn't be limited by the 4kb limit for sending cookies.

I use better auth for a real app

There is a plugin provided by better auth for jwt https://www.better-auth.com/docs/plugins/jwt

We dont need it since everything is a single "server" and cookies are good enough. JWT would be added complexity ( e.g sign out ) that i find it better to not be set as a default.

bonus reading http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#88

Post by Vinnl »

Sorry to hijack this post, but since people who know are likely to look here... Anyone know what's up with Next-Auth/Auth.js? The main author had a post up [1] stating that they would stop their involvement, but that post appears to have been removed.

[1] https://web.archive.org/web/20250419022421/https://balazsorb...

Re: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript

#89

Post by WorldMaker »

vivzkestrel wrote: post #83
WorldMaker wrote: post #39

It feels wrong in 2025 that Passkey support isn't up-front and first class and is relegated to a plugin.

nobody i know uses it. Talk with circles outside tech and ask them "how many passkeys they have". They will ask you what is a passkey

Passkey is weird to recognize as a "brand", especially for mainstream users. It's more interesting to ask the average/mainstream user how many sites and apps they login to with their Face or their Fingerprint, and the numbers there are shifting rapidly and in interesting ways. You'll get a bunch of "false positives" that think any interaction with the iOS or Android built-in password managers count, but those "false positives" are also what is lifting the tide of larger Passkey adoption. The users comfortable with native password managers are also the users getting the easiest auto-enroll paths into using passkeys in supported places.

At this point the chicken and egg onus is on websites to support Passkeys, and to do it as a first-class and recommended experience, not on explaining to average users what a passkey "is" or arguing over how many they have. It is past time for auth frameworks and vendors to start steering people away from passwords (and towards passkeys, whether you want to "brand it" as passkeys or not).

Post reply on HN