Always go back to devise in rails land. It isn't worth the effort to integrate with an external service for the side projects I work on, but maybe I should try it just once
Ask HN: What do you use to build auth?
61–70 of 141 posts
Re: Ask HN: What do you use to build auth?
#62I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I've had to solve in my career took a highly custom ap…
Personal story: Someone in the dark past of my company decided rolling their own auth was fine. Our platform is mostly Django so there's a lot of pieces in place OOTB so they thought it would be easy and it probably was. At some point, whatever this auth system was used for just fell off the websites. Some new login features were added back and they used hosted platform for passwords. Enter me, years later, no idea that auth every existed. Eventually we noticed a database table with thousands of users whose passwords were hashed with a now broken algorithm. They were probably sitting there for years and had copies, backups and snapshots wherever.
Re: Ask HN: What do you use to build auth?
#63I use firebase auth because it’s free at any scale and it takes minutes to set up. It’s backed by google so I’m not kept up at night.
Re: Ask HN: What do you use to build auth?
#64Wrestling with this now for a side project. I've landed on .NETCore+ASP.NET Identity after getting frustrated with NuxtJS+fastify-auth, but that's really because I'm more familiar from my day job and didn't like the SPA road Nuxt was forcing me down. That said, I have a related question I'm hoping the security nerds here can help with: I know it's bad practice to reveal the existence of an account during registration…
I think you should focus on what an attacker gains by your app leaking account existence. Is that knowledge valuable or revealing? If not, then probably not necessary to overcomplicate it.
E.g. in the Shopify case, you learn that an email address has a Shopify account. That should be fine as long as they have some rate-limiting in place on their auth endpoint and enforce good passwords.
YMMV, I'm not a security expert, etc.
Re: Ask HN: What do you use to build auth?
#65Disclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity and…
Just went to the cerbos.dev site-- there is a cookie banner that says you serve targeted ads, and asks me to "accept all". No option to reject tracking/ad cookies. At this point, why even have the banner? Real As*hole design
Sorry about that and thank you for bringing it to our attention. As you might imagine we spend a lot of time on that site and did not notice the option to reject is not available. We will action this very soon.
Re: Ask HN: What do you use to build auth?
#66Not exactly your question, but since you are using NextJS I highly recommend you use its API route[0] support to proxy your backend API calls, which allows you to avoid exposing auth tokens, etc to client web front end [0] https://nextjs.org/docs/api-routes/introduction
If the front end isn’t sending an Auth token back then the front end isn’t logged in. How do you propose making authenticated calls from the client?
Re: Ask HN: What do you use to build auth?
#67Disclaimer: I am the co-founder of Cerbos[0] Auth is actually a combination of two things: authentication and authorization. Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team) There are many providers for each. Authentication is about the user's identity and…
This is very cool. I'm familiar with CASL for authz which also has a Prisma integration; is the main benefit of Cerbos over that the built-in logging?
Built-in logging is definitely one of the main benefits. However, the following are also other major benefits of using a service like Cerbos:
* By running as a standalone service, any part of your application stack (in any language) can make consistent authorization checks
* Support for most major programming languages via SDKs
* Infinite scalability via serverless functions or sidecar deployment model
* GitOps enabled policy development and deployment via a full testing suite for ci/cd pipelines.
* Full audit trails of every decision made and how they were derived.
* Simple human readable YAML policies
* Ability to have different policies for different environments and ability to have canary deployments
Re: Ask HN: What do you use to build auth?
#68[deleted]
Re: Ask HN: What do you use to build auth?
#69I usually write it myself with Django, Django REST Framework and JWTs alongside either Vue.js or Ember (and their with libraries). Truth be told, I usually hate having to do it. That said I’ve never found a reasonable alternative. There are usually differences in each set up that require customisation (for example magic links like you mentioned) and trying to integrate a platform like auth0 feels like it would be as…
Regarding magic links, this is where you are emailed a link and login ? Do you know any libraries that make this easy ? Looking for this myself using Django.
`django-sesame`
Re: Ask HN: What do you use to build auth?
#70I am surprised that I did not find keycloak here…