Hacker News Reader

Comment by badrequest | Hacker News Reader

IMHO not rolling your own auth is asking for stuff like this to happen.

I believe the opposite of this statement to be true

This is a terrible suggestion. Rolling your own auth nowadays is like rolling your own encryption. It’s just a bad idea. OAuth and OIDC are massive specs that are constantly changing and you’re going to be stuck chasing and developing auth instead of your actual product.

I know because this is what my brain dead principal engineer did and I’ve spent the last 3 years chasing RFCs and am now going to spend the next year migrating to Keycloak because I’ve finally convinced my boss that we’re not an auth company.

I agree you shouldn't write every line by hand, you should use libraries, but pretending like OAuth/ODIC require using something like Cognito/Auto0 is just silly. An LLM can crank out the needed code in very little time and give you full control over your auth instead of fighting an auth provider at every turn.

The number of compromises something like Cognito requires are just not worth the perceived gains.

I really whole heartedly disagree and if you think it’s silly I think that you don’t really fully understand the complexity of it. An LLM doesn’t solve everything. You still need to understand the spec, become a domain expert, and design your solution for the parts that the RFCs leave open with undefined behaviour. At the very least if this is your opinion you should start with an open source solution like Keycloak or authentic and fork it if you really need “control”.

I already said that using a library (open source) is a good idea, I just don't think we need to pretend that Auth is so complicated that we need a third-party provider. I don't buy that argument. You should not roll your own low-level code, you should never need to even look at the RFC's, just hook into the Auth library you use (library, not service).

> just hook into the Auth library you use (library, not service).

I think this is a fundamental misunderstanding of how this stuff works. You can't "just use a library". Your identity server is a service, open source or not and you have to align to how they do things.

I'm talking about handling the OAuth token exchange and what not. Your identity server doesn't need to be a separate service, it can be integrated into your backend. At the end of the day it's responsible for making sure client claiming to be X is X. I really don't think this is rocket science.

I've set up email/password, email magic links, SMS 2FA codes, OAuth, and it's never been this magical, mystical thing these "auth providers" want to pretend it is.

Yes, you need to wire up endpoint for you to feed data to the library (tokens), and provide ways to refresh tokens, etc but that's all just wiring up and I don't think that's really that hard (even before LLMs).

I just cannot fathom handing over as much control and third-party auth providers require you to.

This is a terrible take, and to anyone reading this please don't roll your own auth, you will regret it.

There are lots of good options out there that enterprisey abominations.

Reply on news.ycombinator.com