User authentication API, is that needed?
Hi IH,
long time lurker, very first time poster.
I have always been interested in user management and it seems like a standard solution is not yet emerged in the market.
Having a little bit of free time I thought that I could actually build something really simple and I am wondering if any of you is interested.
I was thinking to provide just a single REST entity with two mandatory fields: email and password
The provide CRUD endpoints to this single entity, more endpoint to reset the password (create single-use token and maybe send transactional email) and a way to store session tokens.
Then integrate it with stripe making it first class citizen.
Finally provide a key value store associated with each user.
It is something you guys will find useful?
Will you pay to make it sustainable?
Authentication is hard to get right.
Look at auth0.com and think about you can compete with them. You have more companies out there but auth0 is the cheapest and the most open due to clear pricing and available docs with also reputation in the B2B world. You will find smaller players and also bigger players.
Good luck but clearly think about all the implications. Authentication is more than just an email and password. It’s all about trust and showing / demonstrating you are on top of security best practices.
Honestly, I want something an order of magnitude simpler than auth0
Would it cut it?
Take a look around the web for stormpath (https://stormpath.com/)
They started a company a few years ago to provide exactly this and built themselves into a large player in the space and were scooped up by Okta in 2017.
Personally, I think there's a place for a clean, easy, user auth solution that stays out of the way. Stormpath provided this but is no longer available in their initial implementation format.
I started being interested in user authentication / management when stormpath was starting, I remember that I though at them as my future competitor. Then life happens and I didn't follow up on that project.
auth0 is a big one, Amazon also has their own solution with Cognito (https://aws.amazon.com/cognito/) that I've been researching some. A big factor will be trust though - thinking of all the sites that have been hacked recently, security will need to be the top priority
What scares me is that I simply don't understand how someone can use auth0.
From a developer point of view it seems so complex and big that really I have never used or approach it.
But since it is quite big they must be doing something right...
I've thought about a similar solution myself. I definitely see the value in such a service but I'm not sure if others would.
My idea involved adding some password strength APIs as well using some popular libraries and password dictionaries..
Firebase already sort of solves this problem however and they do a bunch more things like cloud databases and storage..