I try to use libraries because I do not like my software depending on a third party service, especially on such a central thing as authentication. Beware of the

I try to use libraries because I do not like my software depending on a third party service, especially on such a central thing as authentication. Beware of the vendor lock-in: if you choose to externalize this function, keep in mind you might eventually want to switch vendors or implement this functionality on your side. At least choose a vendor that lets export (ALL) your users data. That said, those services (the good ones) tend to offer much more than a simple user database, for example: * Login with Google/Facebook/Twitter/Github/... * Login with IAM services like OpenID Connect / SAML (mostly for big companies) * Two factor authentication, maybe with several token types (TOTP, SMS messages, recovery codes,...) * Password recovery flow * Rate limit the pace of password attempts, in order to prevent brute forcing * Monitor incoming network traffic and block unusual behaviors * Maybe implement a CAPTCHA or similar challenge for users with unusual behavior * Make sure the storage of all secrets is actually properly protected (password hash, password recovery auth tokens, issued OAuth tokens, etc.) * Audit logs If you implement auth(z) by yourself, most likely if you're going to have to sacrifice on some of these points, otherwise you would spend all your time here and never work on your project!