Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta's NextJS-0auth troubles

joshua.hu

Post reply on HN
Print view View original

131–140 of 167 posts

Re: Okta's NextJS-0auth troubles

#131

Post by dizhn »

hi_hi wrote: post #55
jonathaneunice wrote: post #6

Earlier quoted context omitted.

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?

https://goauthentik.io/#comparison

They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.)

It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.

Re: Okta's NextJS-0auth troubles

#132

Post by dspillett »

mmsc wrote: post #101
ecshafer wrote: post #100

Earlier quoted context omitted.

Keycloak is a great authentication suite, not that hard to configure and rock solid. Ill never understand this thinking.

Keycloak has various vulnerabilities they haven't even responded to after a month of reporting them.

Are these documented anywhere? A full month with no response at all puts you firmly in “responsible disclosure” territory if they are not already publicly known. I'm pretty sure DayJob uses keycloak (or at least is assessing it - I'm a bit removed from that side of things these days) so that information could be pertinent to us.

Re: Okta's NextJS-0auth troubles

#133

Post by viraptor »

SAI_Peregrinus wrote: post #38
jonathaneunice wrote: post #6

Earlier quoted context omitted.

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

Yep. They're an Enterprise™ company. That means they prioritize features purchasing departments want, not functionality.

And when something doesn't work well like their super custom LDAP endpoint, talking to support is really painful.

Re: Okta's NextJS-0auth troubles

#134

Post by rckt »

AI enabled engineers.

Dammit, things like this trigger a very strong rejection of actively adopting AI into my workflows. Not the AI tooling itself, but the absolutely irresponsible ways of using it. This is insane.

Re: Okta's NextJS-0auth troubles

#136

Post by fheisler »

dizhn wrote: post #131
hi_hi wrote: post #55

Earlier quoted context omitted.

We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?

https://goauthentik.io/#comparison They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.) It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.

Thanks for the mention! (Authentik Security CEO here.) We've become something of Okta migration experts at this point... Cloudflare moved to us a couple years back after they had to be the ones to let Okta know it'd been breached yet again. [1]

[1] https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...

Re: Okta's NextJS-0auth troubles

#137

Post by dizhn »

fheisler wrote: post #136
dizhn wrote: post #131

Earlier quoted context omitted.

https://goauthentik.io/#comparison They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.) It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.

Thanks for the mention! (Authentik Security CEO here.) We've become something of Okta migration experts at this point... Cloudflare moved to us a couple years back after they had to be the ones to let Okta know it'd been breached yet again. [1] [1] https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...

Cloudflare??? Damn. that is HUGE! Congratulations. You guys have a super solid product full of features and a decent founder. Maybe enterprises don't care about my favorite feature but it makes securing EVERYTHING a breeze. Embedded proxy! That is GOAT.

Re: Okta's NextJS-0auth troubles

#138

Post by ovo101 »

What’s frustrating here is how predictable these issues are. Next.js isn’t some niche framework, yet Okta’s SDK still struggles with basic OAuth flows like redirect handling, cookie persistence, and SSR quirks. That’s not just a bug — it’s a sign of weak integration testing.

The bigger problem is trust. If an identity provider can’t reliably support mainstream frameworks, it undermines confidence in their entire platform. Developers end up spending more time debugging the SDK than building features.

This is why many of us lean toward smaller, well‑maintained libraries (Auth.js, Supabase Auth, etc.). They don’t try to abstract away everything, but they do the fundamentals well — and that’s what matters most in security.

Re: Okta's NextJS-0auth troubles

#139

Post by philipallstar »

Freak_NL wrote: post #59
atonse wrote: post #44

Earlier quoted context omitted.

I agree with the parent post that it's distasteful. There's no value in naming the employee. Whatever that employee did, if the company needed to figure out who it was, they can from the commit hashes, etc. But there's no value in the public knowing the employee's name. Remember that if someone Googles this person for a newer job, it might show up. This is the sort of stuff that can disproportionately harm that perso…

> Remember that if someone Googles this person for a newer job, it might show up. Not to sound too harsh, but this is a person who rudely let AI perform a task badly which should have been handled by just… merging/rebasing the PR after confirming it does what it should do, then couldn't be bothered to reply and instead let the robot handle it, and then refused to fix the mess they made (making the apology void). That…

[flagged]

Re: Okta's NextJS-0auth troubles

#140

Post by gnaman »

dizhn wrote: post #131
hi_hi wrote: post #55

Earlier quoted context omitted.

We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?

https://goauthentik.io/#comparison They have an enterprise version now (mostly for support and bleeding edge features that later make it into the open source product.) It's pretty easy to self host. I have been doing it for a small site for years and I couldn't even get any other open source solution to work. They are mostly huge with less features.

No provider has been able to match Auth0 actions unfortunately. Auth0 allows you to execute custom code at any point in the auth lifecycle and allow/deny based on that or enrich user attributes. Super useful when you have a legacy system that is hard to migrate away from. If anyone has any recommendations I'm all ears
Post reply on HN