Hacker News Reader

Comment by corytheboyd | Hacker News Reader

I know most people are not like this, but I don’t mind setting up auth “over and over”

It’s always a chance to read about what’s changed in the technologies/ideas you usually lean on for it. Apply that simplification that you wish you could have for your already launched application. Maybe you have a need to make your auth slightly more proprietary. If you churn out applications all the time yeah I get why this could all be seen as a waste of time.

I don’t say this to belittle your service at all, looks neat! Just throwing out an alternative viewpoint for the sake of it :)

View on HN

I am annoyed at doing auth over and over, when it's other people's software. The promise of the container revolution was that cross-cutting concerns would be handled by the infrastructure / orchestrator, and applications wouldn't have to care about details like authentication, monitoring, logging, etc. None of that really materialized, though. The actual running/scheduling of workloads is currently in a great state, but the cross-cutting concerns are pretty awful. Or actually, they're good, but very much "bring your own". I use managed Kubernetes, but it doesn't give me managed monitoring, managed logging, managed authentication, etc. (Cloud providers sell that, but you have to do all the integration work. Some random Go binary you download won't accept Identity Aware Proxy JWTs and send your metrics to Stackdriver. You have to make that all work yourself.)

I've run into the situation at least twice where some app has bought into that mindset and made auth an external factor (don't send HTTP requests unless the user is authorized), and found that there was pretty much nothing good to provide that feature. So... I wrote my own thing both times, and am loving it. (You could use it too! But I wouldn't necessarily recommend it: https://github.com/jrockway/jsso2) I never have to think about auth again.

Having also done the infrastructure and library work to get Prometheus/Grafana/Jaeger/Loki doing what I want (https://github.com/jrockway/opinionated-server), I am almost happy with the remaining cross-cutting concerns. I am ever closer to my "1 hour app", where I can just type in some code and have a fully-working production-quality app available to users. I'm not there, but I'm getting closer by the year.

(Sometimes I wonder if we were wrong to totally get rid of the "just rsync some PHP files to a server" model. There were good things and bad things going on there; we should bring the good things back.)

Thank you for open sourcing these libraries. Your mindset of an app in an hours really strikes me as ple asant. I’ve used PHP Yii framework and everything used to work that way. From layout till auth till database modelling and generating everything based on that. Loved it! I spent most of my time working in MySQLWorkbench perfecting the database model and the rest was more or less generated.

Anyway, I’ll definitely look into your libs!

Something else to consider for Auth is Dex: https://dexidp.io/

That is useful for the case where the application you want to run supports OAuth (OIDC actually), and you want to be your own identity provider. The app has to go out of its way to support OIDC, but it's so common that it might be good enough for normal people. And you can turn Dex or another OIDC provider into an authenticating reverse proxy with: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extension...

(I started writing jsso2 before this existed, and didn't want to tie myself to Envoy necessarily... but if I were starting from 0 today, I'd probably just use Dex and that Envoy extension. Seems simple, and has a lot of corporate support behind it for maintenance / security.)

I hate doing auth and commodity features like user admin along with SSO integration, and hooking it all up to both the front and back end. I'd rather be busy doing business related features.

Nothing wrong with that, that’s the right mindset for getting things done

Ofcourse, everyone has their own preference. Thats an interesting perspective as well. My only counter to that would be that its time consuming to roll your own auth for a complex or large scale app. It starts off easy but soon you have to make significant investments in various aspects of auth. That isnt true for all apps ofcourse. Definitely good to keep learning though!

Part of it too is that I tend to work on smaller projects that don’t grow and change indefinitely like startup saas does. If you’re getting something up quickly where the requirements will change all the time, a service like this starts to make way more sense :)

Yes, thats exactly it - from our experience with talking to devs and startups. Once the project starts scaling, things change

I have my own auth solution that I carry with me. If my employer or client has a better auth solution, great I use their's, else I'll give them mine. Which is basically a working implementation of Spring OAuth. And I keep it updated as Spring updates it. I feel that knowing one solution well enough that you can implement any reasonable use case is better than constantly learning and dealing with the shortcomings of other solutions.

When you learn Spring OAuth well enough you can basically bend it to your will. It provides enough hooks and interceptors to do whatever you want. But it has a steep learning curve.

It's fine if you have the sponsor to pay for your time to deeply understand all the security protocols required and to keep up-to-date with those as well as their different implementations.

But complexity is the worst enemy of security because it easily creates loopholes in security. I think anything that can be done to simplify security will exponentially improve security.

Usually what happens to me on side stuff, is I spend so much time on the basic setting up auth and other things that are done over and over.......I burn out and never actually make the business logic of the app lol.

Yeah I don't mind setting up auth. It takes like a week at most for your MVP.

Depends what you mean with "setting up auth". Once you get into enterprise scenarios, where you need SSO for SSH, Git, your public website, internal tools, ability to revoke accesses, handle trusted mobile devices (ie generating QR codes for VPN/Wireguard access), handling 2FA, etc, etc, it takes more than a week. For such scenarios, doing it yourself and doing it correctly becomes immensely difficult.

Agreed. Done right it's a huge time suck.

I’m building a MVP to show off and validate some ideas. I’m using Firebase and set up auth with my react app in about 10 minutes. I’d never spend a week on auth for a MVP.

I was talking about rolling you own email/password auth from scratch. I keep hearing about Firebase and how easy it is. Is that like AWS Cognito? Does it have custom branding or is it a drop-in form? Can it be hooked to your own SQL database?

It's far easier than AWS Cognito. Yes, I've used both.

Firebase auth is as easy as it gets for auth. Want Username/Pass? Just enable it. Want Google, Twitter, Firebase, Apple, Github, etc.? Just enable it, and write the handlers.

Want to hook into your own SQL database? Easy. Set up a firebase listener, that handles the auth event, and write whatever you want (username, auth details) to SQL.

This is a 100% solved problem and Firebase does a superb job it it.

Awesome, this is great to know. I'll have to consider it for my next side project. Unfortunately I just finished rolling my own, so... :)

I never did it, what is a good guide to start? Thanks!

Hey! I don’t have a guide on hand, maybe another commenter will see this and have some resources :) Honestly my experience is just collected from 10 years working with and around other web applications, and as such is a bit ephemeral. I’d say any guides out there on the topic will arm with you enough knowledge to get started, or even working with services like the subject of this post. You’ll see the pieces at play in action, and can learn from them.

OWASP is a good resource for web security related topics. i.e. https://cheatsheetseries.owasp.org/cheatsheets/Authenticatio...

Reply on news.ycombinator.com