5 ms·

Ask HN: Alternatives to Passport Auth

9 points by prmph 4y ago

Is there another open source alternative to passport for auth in an express node API? I am concerned that Passport plugins are not actually vetted for security

adnjoo 4y ago
Jsonwebtokens (jwt)
- highhedgehog 4y ago
  And here it goes the eternal battle on whether JWT are a good solution for authentication or not.
- quickthrower2 4y ago
  jwt is delegating it to someone else right? who might be you (a second service) but someone needs to check a password somewhere
blahblah1234567 4y ago
OP: For such questions and discussions, I recommend getting on IRC [0]. The Libera server [1] IRC is a collection of chatrooms on all kinds of technical topics: programming languages, frameworks, cloud providers, topics often hundreds of people are in each chat room. You can get live Q&A sessions with veteran and highly respected programmers. I've chatted with an engineering director of AirBNB on a channel there, and also a security expert who was tracked by the FBI for a bit, for example-- interesting, intelligent people. Examples of chatrooms ("channels") I am in: #nodejs #python #machinelearning #economics [3] You'll need to learn how to register and login to IRC -- it's pretty easy, just involves a command. For Mac OS I recommend the LimeChat client. [0] https://www.online-tech-tips.com/software-reviews/the-11-best-irc-clients-for-windows-mac-and-linux-in-2022/ https://www.online-tech-tips.com/software-reviews/the-11-bes... [1] https://libera.chat/ https://libera.chat/ [3] https://libera.chat/guides/findingchannels https://libera.chat/guides/findingchannels
mooreds 4y ago
What are you trying to do? Are you storing username and password in your site, or connecting to a social or OIDC provider? What kind of auth are you doing in a node API? (Vs in an express app that generates UX.)
- prmph 4y ago
  OK so I'm actually building a low-code generator for express apps + APIs. The app web UI apps have the usual cookie-based auth through sign-up and sign-in forms, but everything the app does is via the API. So, for the generated APIs, I want to support the following auth strategies: 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API I assume these strategies are sound in general (if not, I'd like to know what the issues are). But, the thing is, I don't want to use any 3rd-party auth services. I'd prefer to use middleware, or a library. I could write my own middleware, but I fear creating something that has some security weaknesses. So what are my options? Passport would seem like a good option, but I am worried that many passport plugins are not vetted, or are they?. It seems anybody can just write and publish a passport plugin.
  - pcthrowaway 4y ago
    When doing OIDC, this one seemed like the best option: https://github.com/auth0/express-openid-connect https://github.com/auth0/express-openid-connect Passport's auth integrations often seem unmaintained, and I don't really like that passport sends the response for you on failure (which means it's not easy to modify, say, to make the response body JSON instead of text) I'm sure Passport is "reasonably" vetted in that it's still the most popular swiss army auth tool in the node.js ecosystem. But I suspect it's not best-in-class for any one type of auth, and auth is really the type of thing you want to be using best-in-class for. By the way, I'm curious what your process is for code generation.. I'm considering a code-gen solution to a problem right now.
  - mooreds 4y ago
ianpurton 4y ago
You could go with a non-framework style of authentication. For example Barricade https://github.com/purton-tech/barricade https://github.com/purton-tech/barricade is a small docker container that handles auth. In terms of security, even if you integrate with a secure authentication system, your integration may be insecure. So a PenTest is recommended anyway.

9 points by prmph 4y ago

Is there another open source alternative to passport for auth in an express node API? I am concerned that Passport plugins are not actually vetted for security

adnjoo 4y ago

Jsonwebtokens (jwt)

highhedgehog 4y ago
And here it goes the eternal battle on whether JWT are a good solution for authentication or not.
quickthrower2 4y ago
jwt is delegating it to someone else right? who might be you (a second service) but someone needs to check a password somewhere

blahblah1234567 4y ago

OP: For such questions and discussions, I recommend getting on IRC [0]. The Libera server [1] IRC is a collection of chatrooms on all kinds of technical topics: programming languages, frameworks, cloud providers, topics often hundreds of people are in each chat room. You can get live Q&A sessions with veteran and highly respected programmers. I've chatted with an engineering director of AirBNB on a channel there, and also a security expert who was tracked by the FBI for a bit, for example-- interesting, intelligent people. Examples of chatrooms ("channels") I am in: #nodejs #python #machinelearning #economics [3] You'll need to learn how to register and login to IRC -- it's pretty easy, just involves a command. For Mac OS I recommend the LimeChat client. [0] https://www.online-tech-tips.com/software-reviews/the-11-best-irc-clients-for-windows-mac-and-linux-in-2022/ https://www.online-tech-tips.com/software-reviews/the-11-bes... [1] https://libera.chat/ https://libera.chat/ [3] https://libera.chat/guides/findingchannels https://libera.chat/guides/findingchannels

mooreds 4y ago

What are you trying to do? Are you storing username and password in your site, or connecting to a social or OIDC provider? What kind of auth are you doing in a node API? (Vs in an express app that generates UX.)

prmph 4y ago
OK so I'm actually building a low-code generator for express apps + APIs. The app web UI apps have the usual cookie-based auth through sign-up and sign-in forms, but everything the app does is via the API. So, for the generated APIs, I want to support the following auth strategies: 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API I assume these strategies are sound in general (if not, I'd like to know what the issues are). But, the thing is, I don't want to use any 3rd-party auth services. I'd prefer to use middleware, or a library. I could write my own middleware, but I fear creating something that has some security weaknesses. So what are my options? Passport would seem like a good option, but I am worried that many passport plugins are not vetted, or are they?. It seems anybody can just write and publish a passport plugin.
- pcthrowaway 4y ago
  When doing OIDC, this one seemed like the best option: https://github.com/auth0/express-openid-connect https://github.com/auth0/express-openid-connect Passport's auth integrations often seem unmaintained, and I don't really like that passport sends the response for you on failure (which means it's not easy to modify, say, to make the response body JSON instead of text) I'm sure Passport is "reasonably" vetted in that it's still the most popular swiss army auth tool in the node.js ecosystem. But I suspect it's not best-in-class for any one type of auth, and auth is really the type of thing you want to be using best-in-class for. By the way, I'm curious what your process is for code generation.. I'm considering a code-gen solution to a problem right now.
- mooreds 4y ago

ianpurton 4y ago

You could go with a non-framework style of authentication. For example Barricade https://github.com/purton-tech/barricade https://github.com/purton-tech/barricade is a small docker container that handles auth. In terms of security, even if you integrate with a secure authentication system, your integration may be insecure. So a PenTest is recommended anyway.