3 ms·
Rolling your own auth is like the first big no no in application security. Unless you're an expert, leave it to the experts
by malfist 2y ago
Rolling your own auth is like the first big no no in application security. Unless you're an expert, leave it to the experts
- PaulHoule 2y agoExactly. It is not the implementation of the auth module that matters to me so much as is the API through which it slots into the rest of the system. I want the expert designed modules that I can plug various systems into. Because we haven’t seen good frameworks at the user management level, I think, the mistakes made by the creators of that YT video are common in the industry.
- zer00eyz 2y ago[flagged]
- throwAGIway 2y agoNot implementing auth doesn't mean using platforms. Just use any of the many OIDC client/server libraries or completely pre-made open source dockerized services. For example react-oidc-context on the client side and Passport.js on the server, or Casdoor.
- darby_nine 2y agoIt only takes your auth provider going down once to abandon this idea entirely, both as a user and a consumer. Edit: dockerized services sound interesting, do you have an example?
- throwAGIway 2y agoCasdoor is one such Docker image, or Authelia, FusionAuth, Authentik or the Ory stack
- darby_nine 2y agoThanks!
- onion2k 2y agoIm sorry but encryption isn't that hard. Login isn't that hard. Session management isn't that hard. Verifying you haven't broken any of these things is hard, and monitoring for breaches when you have a lot of legitimate users is very hard.
- zer00eyz 2y agoVerifying that your vendor hasn't done anything dumb is hard. Supporting your customers when they have problems is hard. Debugging issues with a thrird party in the loop is hard. Just because you farmed out auth doesn't mean you get to stop monitoring for breaches, or doing all the other things you need to do to have an eye on security. Farming out auth just ads a recurring cost per user and complexity that your going to ignore till its a bigger issue than dealing with this up front would have ever been.
- malfist 2y agoI didn't think anyone said you had to farm out auth to a third party platform.
- threatofrain 2y agoNextAuth and company won't do that for you either.
- dang 2y agoPlease make your substantive points thoughtfully and without personal attacks. "The fuck you are talking about" is much too aggressive for this site, as you'll see if you'll review the guidelines. Even "I'm sorry but" is the sort of flamebait we're trying to avoid here. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful. Edit: you've unfortunately been doing this a lot lately: https://news.ycombinator.com/item?id=40819104 https://news.ycombinator.com/item?id=40819104 https://news.ycombinator.com/item?id=40818298 https://news.ycombinator.com/item?id=40818298 https://news.ycombinator.com/item?id=40817238 https://news.ycombinator.com/item?id=40817238 https://news.ycombinator.com/item?id=40810372 https://news.ycombinator.com/item?id=40810372 We have to ban accounts that post like that, so if you'd please fix this, that would be good.
- darby_nine 2y agoAbsolutely disagree. You shouldn't roll your own bcrypt, but you should have full knowledge of how it's used to offer authentication. Hell this is required to even move forward with sales in many enterprise software contexts. If you don't know how passwords work, for the love of god don't offer password-based login.