3 ms·

OK so I'm actually building a low-code generator for express apps + APIs. The app web UI apps have the usual cookie-based auth through sign-up and sign-in form

by prmph 4y ago

OK so I'm actually building a low-code generator for express apps + APIs. The app web UI apps have the usual cookie-based auth through sign-up and sign-in forms, but everything the app does is via the API. So, for the generated APIs, I want to support the following auth strategies: 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API I assume these strategies are sound in general (if not, I'd like to know what the issues are). But, the thing is, I don't want to use any 3rd-party auth services. I'd prefer to use middleware, or a library. I could write my own middleware, but I fear creating something that has some security weaknesses. So what are my options? Passport would seem like a good option, but I am worried that many passport plugins are not vetted, or are they?. It seems anybody can just write and publish a passport plugin.

pcthrowaway 4y ago
When doing OIDC, this one seemed like the best option: https://github.com/auth0/express-openid-connect https://github.com/auth0/express-openid-connect Passport's auth integrations often seem unmaintained, and I don't really like that passport sends the response for you on failure (which means it's not easy to modify, say, to make the response body JSON instead of text) I'm sure Passport is "reasonably" vetted in that it's still the most popular swiss army auth tool in the node.js ecosystem. But I suspect it's not best-in-class for any one type of auth, and auth is really the type of thing you want to be using best-in-class for. By the way, I'm curious what your process is for code generation.. I'm considering a code-gen solution to a problem right now.
mooreds 4y ago
Yeah, I don't know any other options for vanilla JS that support what you want. There are embeddable/self-hostable auth servers (FusionAuth--full disclosure, I work for them, Keycloak, Ory), but it sounds like you don't want to head down that path. > 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API > (if not, I'd like to know what the issues are). For #2, if you are setting up OIDC, you typically don't get to control MFA. You're delegating the authentication event to the upstream identity source, so they control if they ask for additional factors of authentication. For #3, would recommend the client credentials grant for your API clients, which is essentially an API key, but generates a time bound token and is therefore a bit more secure. I don't know whether passport plugins are vetted. I suppose you could ask on the github repo: https://github.com/jaredhanson/passport https://github.com/jaredhanson/passport I didn't see a great way to buy/find support, but maybe there's a slack/discord out there?

by prmph 4y ago

pcthrowaway 4y ago

When doing OIDC, this one seemed like the best option: https://github.com/auth0/express-openid-connect https://github.com/auth0/express-openid-connect Passport's auth integrations often seem unmaintained, and I don't really like that passport sends the response for you on failure (which means it's not easy to modify, say, to make the response body JSON instead of text) I'm sure Passport is "reasonably" vetted in that it's still the most popular swiss army auth tool in the node.js ecosystem. But I suspect it's not best-in-class for any one type of auth, and auth is really the type of thing you want to be using best-in-class for. By the way, I'm curious what your process is for code generation.. I'm considering a code-gen solution to a problem right now.

mooreds 4y ago

Yeah, I don't know any other options for vanilla JS that support what you want. There are embeddable/self-hostable auth servers (FusionAuth--full disclosure, I work for them, Keycloak, Ory), but it sounds like you don't want to head down that path. > 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API > (if not, I'd like to know what the issues are). For #2, if you are setting up OIDC, you typically don't get to control MFA. You're delegating the authentication event to the upstream identity source, so they control if they ask for additional factors of authentication. For #3, would recommend the client credentials grant for your API clients, which is essentially an API key, but generates a time bound token and is therefore a bit more secure. I don't know whether passport plugins are vetted. I suppose you could ask on the github repo: https://github.com/jaredhanson/passport https://github.com/jaredhanson/passport I didn't see a great way to buy/find support, but maybe there's a slack/discord out there?