Okta's NextJS-0auth troubles • Hacker News Board

Re: Okta's NextJS-0auth troubles

#31

Post by kenhwang » Thu, Nov 20, 2025, 7:35 PM UTC

parliament32 wrote: post #11

jonathaneunice wrote: post #6

Earlier quoted context omitted.

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

We evaluated them a while ago but concluded it was amateur-hour all the way down. They seem to be one of those classic tech companies where 90% of resources go to sales/marketing, and engineering remains "minimum viable" hoping they get an exit before anyone notices.

I'm convinced Okta's entire business model is undercutting everyone with a worse product with worse engineering that checks more boxes on the feature page, knowing IT procurement people aren't technical and think more checkboxes means it's better.

Re: Okta's NextJS-0auth troubles

#32

Post by mrcwinn » Thu, Nov 20, 2025, 7:37 PM UTC

theoldgreybeard wrote: post #25

You couldn't pay me a billion dollars to use Okta.

You just literally saved me one billion dollars. The offer was incoming!

Re: Okta's NextJS-0auth troubles

#33

Post by filearts » Thu, Nov 20, 2025, 7:46 PM UTC

I think it is distasteful and disrespectful to call out an employee by name in this way, regardless of the merit of the rest of the OP's post.

Re: Okta's NextJS-0auth troubles

#34

Post by trollbridge » Thu, Nov 20, 2025, 7:53 PM UTC

pphysch wrote: post #27

theoldgreybeard wrote: post #25

You couldn't pay me a billion dollars to use Okta.

Sadly many people will spend a million dollars to use Okta for their 10,000 logins/day (read: OIDC is not scary, and advanced central authorization features (beyond group memberships) are a big ole YAGNI / complexity trap.

The workload to run Authentik locally is about identical to the workload to set up and configure Okta. (Or you could just fine someone who will host Authentik for you, if deploying a container is too hard for you.)

Re: Okta's NextJS-0auth troubles

#35

Post by trollbridge » Thu, Nov 20, 2025, 7:54 PM UTC

Traubenfuchs wrote: post #22

Is there any non shite managed oAuth solution with a free tier available? Auth0 really is super easy and comfortable to integrate and I don‘t want to run my own keycloak or whatever.

Authentik?

Re: Okta's NextJS-0auth troubles

#36

Post by trollbridge » Thu, Nov 20, 2025, 7:54 PM UTC

mananaysiempre wrote: post #21

Aldipower wrote: post #18

WTF is Okta?

An auth integrator, a pretty notable one, mostly (originally?) OAuth I think. Multiple people calling it a trash fire here came as a surprise to me, but I defer to their experience.

Okta was state of the art a decade ago.

Re: Okta's NextJS-0auth troubles

#37

Post by whichquestion » Thu, Nov 20, 2025, 7:57 PM UTC

twodave wrote: post #28

I LOVE LLMs as a learning tool. I HATE LLMs as a communication tool. I know, there are people with serious handicaps who benefit from LLMs in this area. If only I could talk to those people and not wade through all this other garbage. Especially when the AI is being represented as a person, this to me is dishonest. Not to mention annoying, almost more-so than the number of different apps that think they are important…

LLMs have definitely helped me reduce my social anxiety when writing, especially in a technical work setting. I don’t use it like the respondent in the article though, I would feel really embarassed to not edit an llm’s output to be in my own voice. But I feel it helps provide me with some structure in whatever I’m trying to write when I don’t have the mental energy or wherewithal to provide it myself.

Re: Okta's NextJS-0auth troubles

#38

Post by SAI_Peregrinus » Thu, Nov 20, 2025, 8:00 PM UTC

jonathaneunice wrote: post #6

cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

Yep. They're an Enterprise™ company. That means they prioritize features purchasing departments want, not functionality.

Re: Okta's NextJS-0auth troubles

#39

Post by iloveplants » Thu, Nov 20, 2025, 8:20 PM UTC

filearts wrote: post #33

I think it is distasteful and disrespectful to call out an employee by name in this way, regardless of the merit of the rest of the OP's post.

well, it was distasteful of to them to close op's pr and apply the same patch with improper attribution, and then use ai to respond when they were asked about it

Re: Okta's NextJS-0auth troubles

#40

Post by Y_Y » Thu, Nov 20, 2025, 8:20 PM UTC

jonathaneunice wrote: post #6

cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

Okta sucks balls. That's from my perspective as a poor sod who's responsible for some sliver of security at this S&P listed megacorp that makes its purchasing decisions based on golf partners.