4 ms·

Comparing Auth from Supabase, Firebase, Auth.js, Ory, Clerk and Others

6 points by osener 4y ago

kiwicopple 4y ago
(supabase ceo) looks like this is a repost, so I'll copy my comment from last week: https://news.ycombinator.com/item?id=34834322 https://news.ycombinator.com/item?id=34834322 ---- this is a great write up. Some responses to your red flags: No setting for session lifetime - as you point out, there is a setting called "JWT expiry limit". I'll mention this to the Auth team and see if they want to consider changing the name of the setting Client-side unencrypted tokens - we give developers options. Serverside auth is definitely more secure, but that's not always an option (eg, on React). If you have a serverside requirement, you can check out our Auth Helpers [0] which give you several patterns for serverside auth. No 2FA on their own platform - we just released this to the Auth server in December[1]. It's on it's way for the platform. This comment caught my eye: "It also creates the ultimate vendor lock-in". That's surprising! You can pg_dump all your entire database, including your users. I can assure you that's easier than other Auth platforms. With that said, I want to let you know that this is all fair feedback. We _definitely_ care about Auth - it's one of our most important products. We have a dedicated Auth team who are fixing issues based on user feedback, as fast as possible. We receive a flood of feedback across a lot of channels, and we do our best to keep up. From an product perspective, we aim to deliver products that makes sense in a Postgres context - you can see that we think deeply about how this service fits with Row Level Security in our MFA post below. Your article has a lot of actionable insights, which I'll go through with the team to continue this improvement. [0] Auth Helpers: https://supabase.com/docs/guides/auth/auth-helpers https://supabase.com/docs/guides/auth/auth-helpers [1] MFA: https://supabase.com/blog/mfa-auth-via-rls https://supabase.com/blog/mfa-auth-via-rls
- osener 4y ago
  Is the random logouts a known issue internally? I have also experienced this.
  - kiwicopple 4y ago
    Random logouts is usually a symptom of an application error, rather than a bug on with GoTrue. Are you using the Auth Helpers? (https://supabase.com/docs/guides/auth/auth-helpers https://supabase.com/docs/guides/auth/auth-helpers) These establish the best-practice for various frameworks. If you're experiencing logouts using one of these Helpers I'd love to know

6 points by osener 4y ago

(supabase ceo) looks like this is a repost, so I'll copy my comment from last week: https://news.ycombinator.com/item?id=34834322 https://news.ycombinator.com/item?id=34834322 ---- this is a great write up. Some responses to your red flags: No setting for session lifetime - as you point out, there is a setting called "JWT expiry limit". I'll mention this to the Auth team and see if they want to consider changing the name of the setting Client-side unencrypted tokens - we give developers options. Serverside auth is definitely more secure, but that's not always an option (eg, on React). If you have a serverside requirement, you can check out our Auth Helpers [0] which give you several patterns for serverside auth. No 2FA on their own platform - we just released this to the Auth server in December[1]. It's on it's way for the platform. This comment caught my eye: "It also creates the ultimate vendor lock-in". That's surprising! You can pg_dump all your entire database, including your users. I can assure you that's easier than other Auth platforms. With that said, I want to let you know that this is all fair feedback. We _definitely_ care about Auth - it's one of our most important products. We have a dedicated Auth team who are fixing issues based on user feedback, as fast as possible. We receive a flood of feedback across a lot of channels, and we do our best to keep up. From an product perspective, we aim to deliver products that makes sense in a Postgres context - you can see that we think deeply about how this service fits with Row Level Security in our MFA post below. Your article has a lot of actionable insights, which I'll go through with the team to continue this improvement. [0] Auth Helpers: https://supabase.com/docs/guides/auth/auth-helpers https://supabase.com/docs/guides/auth/auth-helpers [1] MFA: https://supabase.com/blog/mfa-auth-via-rls https://supabase.com/blog/mfa-auth-via-rls

osener 4y ago
Is the random logouts a known issue internally? I have also experienced this.
- kiwicopple 4y ago
  Random logouts is usually a symptom of an application error, rather than a bug on with GoTrue. Are you using the Auth Helpers? (https://supabase.com/docs/guides/auth/auth-helpers https://supabase.com/docs/guides/auth/auth-helpers) These establish the best-practice for various frameworks. If you're experiencing logouts using one of these Helpers I'd love to know