19-08-22

Authentication - Roll your own Auth?

Authentication is always a heavily debated topic and I have spent quite some time recently going in depth in the extensive discussions around it.

Don’t do it 😨

The most common thing I have heard is “Don’t roll your own Auth”, which of course sounds like great advice. And it is. But what does that mean? People usually don’t entirely clarify their statement when saying that.

Does this mean only third party “auth-in-a-box” solutions such as Auth0 and Amazon Cognito? Because that has some large implications. That’s trusting and providing access to all your user data (99.99% of the time the most important data) with another company.

Now it’s not as scary as that may seem however the other drawbacks are of course lock-in to their pricing scheme. Which I’ve seen can go from “Wow, can’t believe this is basically free?” to astronomically expensive pretty quickly if you are building a public app with intentions of scaling. This is much less of a concern if your pricing model around your product (for example most SAAS startups) has a high per user profit margin, however for those public free-to-use services; that could be close to zero.

Battle-tested only ⚔️

The other option is maybe they mean don’t do something crazy and roll your own crypto (which sounds obvious but may need to be stated anyway) and build auth from the ground up. Stick to only ever using extremely well-maintained and battle tested authentication libraries, which is much more reasonable and where I feel I land mostly.

There’s some fantastic options out there for authentication libraries, such as the amazing package Next-auth which provides over 50 different sign in options in a simple package that couldn’t be easier to add to your Next.js application. You don’t even need to store passwords if you stick to using OAuth providers and Magic Links.

I’m still nowhere near comfortable providing too much insight on authentication as it is a very difficult topic which has an immense amount of depth. However I thought I would share my recent thoughts here and see how my mind changes on this topic in the future.