I sleep better at night thanks to Spring Security and KISS. [1]

Reading the docs from top to bottom, and diving into the source code makes me believe that "you should never roll your own auth" should be an addendum to "you should never roll your own crypto". The number of edge cases and gotchas is simply mind-boggling. It's not about being a good enough programmer to cover yourself, but about years of collective experience dealing with all sorts of exploits and browser shenanigans.

[1] https://docs.spring.io/spring-security/reference/servlet/aut...