Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Node.js authentication tutorial is wrong

medium.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Your Node.js authentication tutorial is wrong

#11

Post by camus2 »

> Stack Overflow isn’t of too much help, as developer relations from a company called Stormpath loved plugging their IaaS startup on every imaginable post regarding this. Their documentation also popped up everywhere and they have a blogvertisement on password reset, as well. However, all of this is for naught as Stormpath is defunct, and it shuts down entirely August 17, 2017.

I remember these guys and I had a serious argument back them with one of the. I pity companies who bought into their services and depend on it today. People often push the idea that security and ID management should be "outsourced". They shouldn't, security audits should.

Re: Your Node.js authentication tutorial is wrong

#12

Post by camus2 »

ameliaquining wrote: post #5
hobarrera wrote: post #2

Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.

So what are the current good options in Node?

If you're looking for a rails/devise like solution there is none. Passport is just an express middleware which is mostly useless, just like express in general.

Re: Your Node.js authentication tutorial is wrong

#15

Post by zxcmx »

ameliaquining wrote: post #5
hobarrera wrote: post #2

Authentication is hard. And that's exactly why you should never have to be writing your own auth code, but rather, use existing frameworks. There's so many tiny details and edge cases that can have such catastrophic results, it's too much of a risk to do it yourself. Unless writing auth frameworks is your job, for course.

So what are the current good options in Node?

Probably firebase, auth0, cognito or a similar third-party system. To me that fits in with the node ethos, which has always seemed to be to be, roughly, "mash things up".

Re: Your Node.js authentication tutorial is wrong

#17

Post by mcappleton »

micaksica wrote: post #10
mcappleton wrote: post #8

Earlier quoted context omitted.

Honestly, I don't think there is a real shortcut for in depth knowledge of how secure authentication should work. I think if your going to be writing a program with authentication, you need to know what is going on, what the framework is doing under the hood. If you don't, you are likely to misconfigure it or trust it to do something it doesn't do. Writing a secure auth isn't exactly hard, and there is good info on t…

I disagree. Do you believe that web application developers should be able to write an efficient JavaScript interpreter, or build a working CPU in Verilog? As technology increases in complexity, roles specialize. Skillsets diverge and junior developers should have frameworks accessible to them they can rely on. Most of us have made our careers standing upon the shoulders of relative giants until we have grown enough t…

If you don't understand CPU cycles, your application might get a teeny bit slower. If you don't understand security, your application could get hacked! It's definitely nice to have a good auth framework, but I think security is important enough that it's worth taking 1 hour to learn how to do it right.
Post reply on HN