> if Laravels or Phoenix generated auth isn't safe What makes you think they're not safe? Zillions of successful apps have been built using Laravel and Phoenix

> if Laravels or Phoenix generated auth isn't safe What makes you think they're not safe? Zillions of successful apps have been built using Laravel and Phoenix and (afaik) no-one has hacked their auth code yet. The code is open-source for anyone to inspect for vulnerabilities. I wouldn't feel unsafe using them. You seem to misunderstand what it means to "roll your own auth". "Don't roll your own auth" doesn't mean "use a third-party auth provider". It means "use an existing, expert-made auth solution and don't try to write it yourself." That can be a third-party provider like Firebase, it can be a code dependency like Rails's Devise, it can be generated by `phx.gen.auth` in Phoenix, it doesn't matter - the point is that you're using a tried-and-tested auth solution written by someone who knows what they're doing. Writing your own auth code is generally a bad idea because it's complicated, time-consuming and easy to get wrong. But there are zillions of off-the-shelf solutions you can use that have been created by security experts and battle-tested in thousands of production apps. As far as I'm concerned, web auth is a solved problem.