> How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn

> How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated. Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.