It's been said a few times here, but it's important so I'm calling it out on the top level: Don't roll your own auth. But do feel free to use a battle tested a

It's been said a few times here, but it's important so I'm calling it out on the top level: Don't roll your own auth. But do feel free to use a battle tested auth library / or framework hosted in your own app. Then you get both benefits: 1. You don't have to put your destiny in someone else's hands, and 2. You're not getting the risks associated with building your own auth.