Hacker News Reader

Comment by js4ever | Hacker News Reader

Congrats for launching! You should really simplify the process, because right now after reading your quickstart it seems more complicated to use this compared to implementing a basic auth system inside the app

View on HN

Thanks! This is good feedback. The guide is effectively a verbose walkthrough setting up OAuth Proxy, which is the only way you could add authorization to a pre-existing application outside of your control, for example Prometheus.

For new projects, it might seem like picking up built-in auth system is easier until you realize you have to build a model of hierarchies of organizations, groups, etc... In my experience, some of these libraries cannot even express that model despite it being the most commonly required for web apps. ShareWith implements that model for you and even handles some of the trickier corner-cases like arbitrarily nesting groups.

Might it be possible for ShareWith to authenticate with my application using some simple method (e.g. a shared secret HTTP header)? Then I could get all the benefits of the auth model without having to install anything (other than my app).

In theory, you could provide an auth header representing your incoming user to our API and verify that way, yes. You'd still need to perform authentication (using Auth0 right now, as that is what ShareWith uses) to identify which user is hitting your application, but then the authorization check could be done via the API.

Reply on news.ycombinator.com