> Yup, that's right... I hand-rolled my own authentication on this site. But I had a good reason! Remember all the talk above about making things super fast by

> Yup, that's right... I hand-rolled my own authentication on this site. But I had a good reason! Remember all the talk above about making things super fast by collocating the node servers and databases close to users? Well, I'd kinda undo all that work if I used an authentication service. Every request would have to go to the region that provider supported to verify the user's logged in state. How disappointing would that be? If this is serious I'm horrified that you went down this path. Having requests going to some regions you're not happy with is not a reason to compromise your users' security by handrolling your own flow. What's awful is that there are people who will read this and think it's a perfectly reasonable thing to do. You are not a security expert, that much is clear. Because you wouldn't have uttered those first two sentences in the first place.