Has anyone built their own authentication system? I'm building out a website (never did full stack before) and am implementing authentication. It's turning out to be more work than I expected. Is it unreasonable to implement auth yourself with JWTs? You also need to setup email sending for verification which takes more time. |
Personally I think the problem is we are being sold so many 'conveniences'/solutions these days. They want you to think you cannot safely do it yourself, and on top of that, often times it's actually more difficult just to learn how to use whatever API the convenience that's being sold to us, uses.
You are often better off learning what is really happening under the hood, and solving the actual problem, instead of trying to figure out whatever api/tool that is being sold to you as a convenience. EDIT: to clarify, if you are inexperienced: I recommend learning by implementing both session + JWT auth on a side project, before using hand-rolled solutions in production.
The talk about replacing it is with OAuth2, so the result will be that integrating with any service will be more difficult than writing the entire auth service in the first place, but what can you do.
*difficult not as in "hard to implement", more as in "lots of moving parts, hard to maintain"
I've used randomly salted SHA512 to create a stored password. What's wrong with that?
The recommendation that I'm familiar with is to increase the cost as high as your servers can reasonably bear. High number of iterations and more advanced algorithms will increase the load on your servers but in turn they'll also provide much better protection.
Of course downside is that once you move to multiserver you have to think of setting up sticky loadbalancing or distributed sessions.
https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial...
Unless you are more experienced and smarter than average engineer working on a 3d party solution - you should build your own only for educational purposes.
You would either use something like Firebase Auth or the built-in one that comes with your framework of choice. Identity in .NET core for example.
On the topic of auth, and as an aside, wondering if anyone has used a UUID + API key combination to do auth instead of JWT/cookies?
Store users with an username/email and scrypt-encrypted password.
On login, pull the encrypted password where username = $1. Compare. If valid, create a session id (fill 16 bytes with a cryptographically secure random number generator and encode it), store it that in the db along the user_id and some expiration time.
You now have a session_id -> user_id mapping which can.
Even better nowadays, there are multiple SaaS/starter kits you can use (most are paid) that remove all these chores and you can get down to your domain flow.
However, my own experience is that the API's are in fact more complex to deal with than just setting it up yourself. So at least for MVP's, I wouldn't recommend it.
You should consider one of the many frameworks that handle this sort of thing for you (every language has them.)
It is unclear from your comment how you might be helped.
It was pretty boring and grinding. For a personal site, I’d use something off the shelf for sure.