Hacker News Reader

If you want to use an authentication solution which will not make you want to roll your own and highly configurable, use rodauth: http://rodauth.jeremyevans.net/

View on HN

Rodauth is really great. We had a partially hand-rolled solution and it was time to add MFA so decided to migrate rather than build more of our own authentication logic, it was definitely the right call.

I looked at it awhile ago but it appears to require Roda. Which seems a bit heavy dependency on the surface.

Roda is as lightweight as it gets, when it comes to ruby web routers. If you're worried about heavy dependencies, you should probably look into rails first.

Yes, Rails is a heavy framework. But strapping another framework on top of rails just for authentication smells pretty bad.

The reality may be different, but superficially it seems odd.

Roda is not a full blown framework. The footprint of rodauth overall is quite low, when compared. Couple that with the fact that you get 2 factors, sms, otp, webauthn, json mode, argon2, along with json mode + an array of security and usability features, from a single dependency.

The website shows code examples for use in non-Roda applications, and the readme states:

> Rodauth is Ruby's most advanced authentication framework, designed to work in any rack application.

Reply on news.ycombinator.com