5 ms·

I know most people are not like this, but I don’t mind setting up auth “over and over” It’s always a chance to read about what’s changed in the technologies/id

I know most people are not like this, but I don’t mind setting up auth “over and over” It’s always a chance to read about what’s changed in the technologies/ideas you usually lean on for it. Apply that simplification that you wish you could have for your already launched application. Maybe you have a need to make your auth slightly more proprietary. If you churn out applications all the time yeah I get why this could all be seen as a waste of time. I don’t say this to belittle your service at all, looks neat! Just throwing out an alternative viewpoint for the sake of it :)

karakot 6y ago
I never did it, what is a good guide to start? Thanks!
- corytheboyd 6y ago
  Hey! I don’t have a guide on hand, maybe another commenter will see this and have some resources :) Honestly my experience is just collected from 10 years working with and around other web applications, and as such is a bit ephemeral. I’d say any guides out there on the topic will arm with you enough knowledge to get started, or even working with services like the subject of this post. You’ll see the pieces at play in action, and can learn from them.
- tynorf 6y ago
  OWASP is a good resource for web security related topics. i.e. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Authenticatio...
chaostheory 6y ago
I hate doing auth and commodity features like user admin along with SSO integration, and hooking it all up to both the front and back end. I'd rather be busy doing business related features.
- corytheboyd 6y ago
  Nothing wrong with that, that’s the right mindset for getting things done
advaitruia 6y ago
Ofcourse, everyone has their own preference. Thats an interesting perspective as well. My only counter to that would be that its time consuming to roll your own auth for a complex or large scale app. It starts off easy but soon you have to make significant investments in various aspects of auth. That isnt true for all apps ofcourse. Definitely good to keep learning though!
- corytheboyd 6y ago
  Part of it too is that I tend to work on smaller projects that don’t grow and change indefinitely like startup saas does. If you’re getting something up quickly where the requirements will change all the time, a service like this starts to make way more sense :)
  - advaitruia 6y ago
    Yes, thats exactly it - from our experience with talking to devs and startups. Once the project starts scaling, things change
anonytrary 6y ago
Yeah I don't mind setting up auth. It takes like a week at most for your MVP.
- frenchman99 6y ago
  Depends what you mean with "setting up auth". Once you get into enterprise scenarios, where you need SSO for SSH, Git, your public website, internal tools, ability to revoke accesses, handle trusted mobile devices (ie generating QR codes for VPN/Wireguard access), handling 2FA, etc, etc, it takes more than a week. For such scenarios, doing it yourself and doing it correctly becomes immensely difficult.
  - nullsense 6y ago
    Agreed. Done right it's a huge time suck.
- leesalminen 6y ago
  I’m building a MVP to show off and validate some ideas. I’m using Firebase and set up auth with my react app in about 10 minutes. I’d never spend a week on auth for a MVP.
  - anonytrary 6y ago
    I was talking about rolling you own email/password auth from scratch. I keep hearing about Firebase and how easy it is. Is that like AWS Cognito? Does it have custom branding or is it a drop-in form? Can it be hooked to your own SQL database?
    - rubicon33 6y ago
      It's far easier than AWS Cognito. Yes, I've used both. Firebase auth is as easy as it gets for auth. Want Username/Pass? Just enable it. Want Google, Twitter, Firebase, Apple, Github, etc.? Just enable it, and write the handlers. Want to hook into your own SQL database? Easy. Set up a firebase listener, that handles the auth event, and write whatever you want (username, auth details) to SQL. This is a 100% solved problem and Firebase does a superb job it it.
jrockway 6y ago
I am annoyed at doing auth over and over, when it's other people's software. The promise of the container revolution was that cross-cutting concerns would be handled by the infrastructure / orchestrator, and applications wouldn't have to care about details like authentication, monitoring, logging, etc. None of that really materialized, though. The actual running/scheduling of workloads is currently in a great state, but the cross-cutting concerns are pretty awful. Or actually, they're good, but very much "bring your own". I use managed Kubernetes, but it doesn't give me managed monitoring, managed logging, managed authentication, etc. (Cloud providers sell that, but you have to do all the integration work. Some random Go binary you download won't accept Identity Aware Proxy JWTs and send your metrics to Stackdriver. You have to make that all work yourself.) I've run into the situation at least twice where some app has bought into that mindset and made auth an external factor (don't send HTTP requests unless the user is authorized), and found that there was pretty much nothing good to provide that feature. So... I wrote my own thing both times, and am loving it. (You could use it too! But I wouldn't necessarily recommend it: https://github.com/jrockway/jsso2 https://github.com/jrockway/jsso2) I never have to think about auth again. Having also done the infrastructure and library work to get Prometheus/Grafana/Jaeger/Loki doing what I want (https://github.com/jrockway/opinionated-server https://github.com/jrockway/opinionated-server), I am almost happy with the remaining cross-cutting concerns. I am ever closer to my "1 hour app", where I can just type in some code and have a fully-working production-quality app available to users. I'm not there, but I'm getting closer by the year. (Sometimes I wonder if we were wrong to totally get rid of the "just rsync some PHP files to a server" model. There were good things and bad things going on there; we should bring the good things back.)
- highmastdon 6y ago
  Thank you for open sourcing these libraries. Your mindset of an app in an hours really strikes me as ple asant. I’ve used PHP Yii framework and everything used to work that way. From layout till auth till database modelling and generating everything based on that. Loved it! I spent most of my time working in MySQLWorkbench perfecting the database model and the rest was more or less generated. Anyway, I’ll definitely look into your libs!
galaxyLogic 6y ago
It's fine if you have the sponsor to pay for your time to deeply understand all the security protocols required and to keep up-to-date with those as well as their different implementations. But complexity is the worst enemy of security because it easily creates loopholes in security. I think anything that can be done to simplify security will exponentially improve security.
jmartrican 6y ago
I have my own auth solution that I carry with me. If my employer or client has a better auth solution, great I use their's, else I'll give them mine. Which is basically a working implementation of Spring OAuth. And I keep it updated as Spring updates it. I feel that knowing one solution well enough that you can implement any reasonable use case is better than constantly learning and dealing with the shortcomings of other solutions. When you learn Spring OAuth well enough you can basically bend it to your will. It provides enough hooks and interceptors to do whatever you want. But it has a steep learning curve.
meatpuppeting 6y ago
Usually what happens to me on side stuff, is I spend so much time on the basic setting up auth and other things that are done over and over.......I burn out and never actually make the business logic of the app lol.

karakot 6y ago

I never did it, what is a good guide to start? Thanks!

corytheboyd 6y ago
Hey! I don’t have a guide on hand, maybe another commenter will see this and have some resources :) Honestly my experience is just collected from 10 years working with and around other web applications, and as such is a bit ephemeral. I’d say any guides out there on the topic will arm with you enough knowledge to get started, or even working with services like the subject of this post. You’ll see the pieces at play in action, and can learn from them.
tynorf 6y ago
OWASP is a good resource for web security related topics. i.e. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Authenticatio...

chaostheory 6y ago

I hate doing auth and commodity features like user admin along with SSO integration, and hooking it all up to both the front and back end. I'd rather be busy doing business related features.

corytheboyd 6y ago
Nothing wrong with that, that’s the right mindset for getting things done

advaitruia 6y ago

Ofcourse, everyone has their own preference. Thats an interesting perspective as well. My only counter to that would be that its time consuming to roll your own auth for a complex or large scale app. It starts off easy but soon you have to make significant investments in various aspects of auth. That isnt true for all apps ofcourse. Definitely good to keep learning though!

corytheboyd 6y ago
Part of it too is that I tend to work on smaller projects that don’t grow and change indefinitely like startup saas does. If you’re getting something up quickly where the requirements will change all the time, a service like this starts to make way more sense :)
- advaitruia 6y ago
  Yes, thats exactly it - from our experience with talking to devs and startups. Once the project starts scaling, things change

anonytrary 6y ago

Yeah I don't mind setting up auth. It takes like a week at most for your MVP.

frenchman99 6y ago
Depends what you mean with "setting up auth". Once you get into enterprise scenarios, where you need SSO for SSH, Git, your public website, internal tools, ability to revoke accesses, handle trusted mobile devices (ie generating QR codes for VPN/Wireguard access), handling 2FA, etc, etc, it takes more than a week. For such scenarios, doing it yourself and doing it correctly becomes immensely difficult.
- nullsense 6y ago
  Agreed. Done right it's a huge time suck.
leesalminen 6y ago
I’m building a MVP to show off and validate some ideas. I’m using Firebase and set up auth with my react app in about 10 minutes. I’d never spend a week on auth for a MVP.
- anonytrary 6y ago
  I was talking about rolling you own email/password auth from scratch. I keep hearing about Firebase and how easy it is. Is that like AWS Cognito? Does it have custom branding or is it a drop-in form? Can it be hooked to your own SQL database?
  - rubicon33 6y ago
    It's far easier than AWS Cognito. Yes, I've used both. Firebase auth is as easy as it gets for auth. Want Username/Pass? Just enable it. Want Google, Twitter, Firebase, Apple, Github, etc.? Just enable it, and write the handlers. Want to hook into your own SQL database? Easy. Set up a firebase listener, that handles the auth event, and write whatever you want (username, auth details) to SQL. This is a 100% solved problem and Firebase does a superb job it it.

jrockway 6y ago

I am annoyed at doing auth over and over, when it's other people's software. The promise of the container revolution was that cross-cutting concerns would be handled by the infrastructure / orchestrator, and applications wouldn't have to care about details like authentication, monitoring, logging, etc. None of that really materialized, though. The actual running/scheduling of workloads is currently in a great state, but the cross-cutting concerns are pretty awful. Or actually, they're good, but very much "bring your own". I use managed Kubernetes, but it doesn't give me managed monitoring, managed logging, managed authentication, etc. (Cloud providers sell that, but you have to do all the integration work. Some random Go binary you download won't accept Identity Aware Proxy JWTs and send your metrics to Stackdriver. You have to make that all work yourself.) I've run into the situation at least twice where some app has bought into that mindset and made auth an external factor (don't send HTTP requests unless the user is authorized), and found that there was pretty much nothing good to provide that feature. So... I wrote my own thing both times, and am loving it. (You could use it too! But I wouldn't necessarily recommend it: https://github.com/jrockway/jsso2 https://github.com/jrockway/jsso2) I never have to think about auth again. Having also done the infrastructure and library work to get Prometheus/Grafana/Jaeger/Loki doing what I want (https://github.com/jrockway/opinionated-server https://github.com/jrockway/opinionated-server), I am almost happy with the remaining cross-cutting concerns. I am ever closer to my "1 hour app", where I can just type in some code and have a fully-working production-quality app available to users. I'm not there, but I'm getting closer by the year. (Sometimes I wonder if we were wrong to totally get rid of the "just rsync some PHP files to a server" model. There were good things and bad things going on there; we should bring the good things back.)

highmastdon 6y ago
Thank you for open sourcing these libraries. Your mindset of an app in an hours really strikes me as ple asant. I’ve used PHP Yii framework and everything used to work that way. From layout till auth till database modelling and generating everything based on that. Loved it! I spent most of my time working in MySQLWorkbench perfecting the database model and the rest was more or less generated. Anyway, I’ll definitely look into your libs!

galaxyLogic 6y ago

It's fine if you have the sponsor to pay for your time to deeply understand all the security protocols required and to keep up-to-date with those as well as their different implementations. But complexity is the worst enemy of security because it easily creates loopholes in security. I think anything that can be done to simplify security will exponentially improve security.

jmartrican 6y ago

I have my own auth solution that I carry with me. If my employer or client has a better auth solution, great I use their's, else I'll give them mine. Which is basically a working implementation of Spring OAuth. And I keep it updated as Spring updates it. I feel that knowing one solution well enough that you can implement any reasonable use case is better than constantly learning and dealing with the shortcomings of other solutions. When you learn Spring OAuth well enough you can basically bend it to your will. It provides enough hooks and interceptors to do whatever you want. But it has a steep learning curve.

meatpuppeting 6y ago

Usually what happens to me on side stuff, is I spend so much time on the basic setting up auth and other things that are done over and over.......I burn out and never actually make the business logic of the app lol.