02-09-22

Next.js Authentication

I thoroughly enjoy using Next.js and it is my default choice when building any new web application. I’ve spent quite a bit of time recently obsessing over the right choices for Authentication (AuthN) when using Next and even other frameworks too. So here’s a very, very brief rundown of my thoughts and experiences.

Next-auth

Next Auth seems like the go-to. It’s a well-documented and well-written solution that can get you up and running with protected routes in no time. It’s very simple to get started and throw in the OAuth provider of your choice - just like that you have authenticated users.

It’s connection with Primsa was good (though had some small quirks that needed schema changes) and everything worked as expected. Except for one thing.

Regular old email/password login. If you have that requirement, and to be fair there’s lots of arguements against it, that’s where Next-auth really isn’t a great solution for that particular problem.

The maintainers of Next-auth delibrately cripple the implmenation of the ‘Credentials’ login path as they fundamentally believe it’s insecure and you should avoid it at all costs. Which again has it’s merits but a lot of times that isn’t exactly practical when it comes to business requirements.

Auth0

My experience with Auth0 is not as full-fledged as the other solutions I have mentioned however I have still implemented a working concept with the platform and I have my reasons for not going futher. And that is their pricing model.

From my own experience to countless testimonials online, Auth0 has great DX, easy to setup, great range of features and fairly generous free tier. Sounds great right? Except for the little fact that 2FA/MFA has a minimum cost of $27k/year. Yes, $27000 annually.

For any semi-professional startup, app or otherwise multi-factor authentication is not a niceity, it’s a necesscity. For me based on principle alone and fear of what they would raise next I would avoid except for concepts.

AWS Cognito

I’ll be quick about this seeming I have posted about Cognito in my last few posts already. It’s pricing is easily the best I’ve seen; 50k monthly active users free with MFA support, SSO and social logins and more.

The first issue I have with it as I mentioned previously, the documentation is seriously awful. There’s three different npm packages you can use to interact with them and the first two packages are quite abstracted and high-level and leave gaps in explaining simple functionality are how certain API calls work. Also bundle size. The other “lower-level” API I couldn’t even find examples of, just an API reference page. The aws-sdk v3 documentation is extremely confusing and I don’t know if I’m alone in that.

The other issue is vendor lock-in, as they are one of the only Auth platforms that do not allow you to export out your user’s hashed passwords. Which is a frustrating move that makes it much more of a scarier decsion when choosing to go with Cognito for an important application that you wish to scale up.

Other platforms I’ve only looked at or read about.

Ory.sh

This platform looks great. First of all, their authenciation is open source - that’s a big positive and the kind of thing that gives you a lot of reassurance when looking to couple your app to a platform in this way. Their pricing structure is very clear and the seem to have a decent-size team. It’s also the only hosted UI I actually really liked out of all these solutions and would possibly even use. The only downside here I saw was that their free tier is limited to development only. So all production apps are minium $18/year.

Clerk.dev

I found this platform mentioned in the Next.js docs and the founder is often commenting on Reddit posts about Authentication and detailing the value his product provides. From reading his comments and the marketing site, I think they offer a great solution however their free tier isn’t as generous as the others and some of the extra features might be missing. Definitely worth considering though.

Supertokens.io

Honestly, this platform almost ticks every box for me and my typical use case. The company seems very transparent on pricing and their goals, has a self-hosting option, is open-source and has a free tier with MFA up to 5000 MAU? Seems almost too good to be true.

My only reserve with SuperTokens was they don’t seem to have the popularity and backing like these other platforms usually have from my searching around the internet. However they have a discord you can join and from my quick look everyone seems super helpful and the founders are in there answering as many questions as they can. They’ve been around since at least 2020 but I hope they continue to gain traction and can really compete in this space in the future as their offering is really great.

All this is a headache, rolling my own sounds easier.

No seriously, that’s honestly how it feels after diving into all of this. Especially after trying to work with Cognito. I did also write a post about “rolling your own auth” before, check it out.