Hacker News Reader

Comment by jc_811 | Hacker News Reader

Some initial findings I've seen are:

Supabase. Pros: affordable, production ready, and seems relatively quick to get up and running. Cons: Some have mentioned security concerns around how they handle auth, and potential complexity around having lots of application logic at the DB level

Nhost: Seems like a really great Supabase alternative, strong focus on graphQL. Con: they are new with a very small team which always concerns me in the case they need to suddenly shut down in the future

Xano. Pros: Probably the quickest to get up and running and delivering JSON to the frontend. Cons: full "no code" solution as opposed to "low code". They do advertise as being turing-complete and able to do anything code can do, but full no-code always gives me pause for a production application passed an MVP

View on HN

> Some have mentioned security concerns around how they handle auth

(Supabase maintainer) Just to sure: supabase is secure, audited, pentested, and well-maintained.

You can use it as a Postgres database, connecting to it in a "traditional" way. Or you can use it with some additional tools that we provide on top, so that you don't need to worry about middleware. Both are as secure as each other, but they require you, the developer, to take responsibility for your application security.

The latter relies on Postgres Row Level Security: it's built into Postgres and isn't novel to Supabase (but we are one of the few who really advocate for it because, well, we love Postgres and we're postgres-maxis)

Hi - really appreciate the response here! This is one of the areas that's given me confusion, as a front-end dev I'm not totally familiar with how to securely set-up auth on the backend. My ideal tool would take care of this lift for me. Tbh I was surprised to see people commenting on concerns for Supabase auth as (from what I can tell) it's a battle-tested production ready platform.

> My ideal tool would take care of this lift for me.

we have several starters [0] to get you started. Eventually you will need to become famliar with any auth system you adopt though. We chose RLS, because it's incredibly flexible and compatible with other tools.

But there are a plethora of other tools if you don't want to take that route. If it works with Postgres, it also works with supabase.

[0] https://supabase.com/blog/supabase-bootstrap

Definitely agree with you! When building I fully expect to learn and become comfortable with whichever auth system I'm using, just to start I need one with everything included to avoid attempting to build one myself.

Thanks for the link, will definitely check that out

Reply on news.ycombinator.com