3 ms·

I agree you shouldn't write every line by hand, you should use libraries, but pretending like OAuth/ODIC require using something like Cognito/Auto0 is just sill

I agree you shouldn't write every line by hand, you should use libraries, but pretending like OAuth/ODIC require using something like Cognito/Auto0 is just silly. An LLM can crank out the needed code in very little time and give you full control over your auth instead of fighting an auth provider at every turn. The number of compromises something like Cognito requires are just not worth the perceived gains.

vips7L 2mo ago
I really whole heartedly disagree and if you think it’s silly I think that you don’t really fully understand the complexity of it. An LLM doesn’t solve everything. You still need to understand the spec, become a domain expert, and design your solution for the parts that the RFCs leave open with undefined behaviour. At the very least if this is your opinion you should start with an open source solution like Keycloak or authentic and fork it if you really need “control”.
- joshstrange 2mo ago
  I already said that using a library (open source) is a good idea, I just don't think we need to pretend that Auth is so complicated that we need a third-party provider. I don't buy that argument. You should not roll your own low-level code, you should never need to even look at the RFC's, just hook into the Auth library you use (library, not service).
  - vips7L 2mo ago
    > just hook into the Auth library you use (library, not service). I think this is a fundamental misunderstanding of how this stuff works. You can't "just use a library". Your identity server is a service, open source or not and you have to align to how they do things.
    - joshstrange 2mo ago
      I'm talking about handling the OAuth token exchange and what not. Your identity server doesn't need to be a separate service, it can be integrated into your backend. At the end of the day it's responsible for making sure client claiming to be X is X. I really don't think this is rocket science. I've set up email/password, email magic links, SMS 2FA codes, OAuth, and it's never been this magical, mystical thing these "auth providers" want to pretend it is. Yes, you need to wire up endpoint for you to feed data to the library (tokens), and provide ways to refresh tokens, etc but that's all just wiring up and I don't think that's really that hard (even before LLMs). I just cannot fathom handing over as much control and third-party auth providers require you to.

vips7L 2mo ago

I really whole heartedly disagree and if you think it’s silly I think that you don’t really fully understand the complexity of it. An LLM doesn’t solve everything. You still need to understand the spec, become a domain expert, and design your solution for the parts that the RFCs leave open with undefined behaviour. At the very least if this is your opinion you should start with an open source solution like Keycloak or authentic and fork it if you really need “control”.

joshstrange 2mo ago
I already said that using a library (open source) is a good idea, I just don't think we need to pretend that Auth is so complicated that we need a third-party provider. I don't buy that argument. You should not roll your own low-level code, you should never need to even look at the RFC's, just hook into the Auth library you use (library, not service).
- vips7L 2mo ago
  > just hook into the Auth library you use (library, not service). I think this is a fundamental misunderstanding of how this stuff works. You can't "just use a library". Your identity server is a service, open source or not and you have to align to how they do things.
  - joshstrange 2mo ago
    I'm talking about handling the OAuth token exchange and what not. Your identity server doesn't need to be a separate service, it can be integrated into your backend. At the end of the day it's responsible for making sure client claiming to be X is X. I really don't think this is rocket science. I've set up email/password, email magic links, SMS 2FA codes, OAuth, and it's never been this magical, mystical thing these "auth providers" want to pretend it is. Yes, you need to wire up endpoint for you to feed data to the library (tokens), and provide ways to refresh tokens, etc but that's all just wiring up and I don't think that's really that hard (even before LLMs). I just cannot fathom handing over as much control and third-party auth providers require you to.