Building a complete authentication and authorization library for NodeJS
I recently used PassportJS for a project; I feel that there is a huge gap. There are a ton of things that you still have to implement yourself, and in the case of authentication and authorization amateur coding could be dangerous.
Auth0 is a good service, but I am looking for something more on self-hostes side, like a library to directly use in the code, just like PassportJS. I want to implement all the features of Auth0 in an opensource library.
I can't find what I am looking for, so I am building one. Would absolutely love to know your views on this problem. Also, it would be awesome if you could share how you implement user management, authentication, and authorization in your apps!
I wish it is more like Devise in Rails. You make it all work in 5 minutes.
Yes, that's what I was inspired from at first place. :)
There is the same thing with AdonisJs, a built-in module, it takes 5 minutes to implement
Wow! This looks awesome framework!
Seems legit. Will consider it on my next project. Thx
So I'm familiar with Passport, Auth0, Okta, AWS Cognito, etc. and I think it really comes down to Firebase Auth or AWS Cognito. My opinion with auth is you want one that integrates well with the rest of your cloud, so you don't have to sync a bunch of crap across your databases and write too much extra auth logic for every little thing. So Firebase plays nicely with Google Cloud, and Cognito plays nicely with the rest of AWS. For React Native specifically, I really like Firebase Auth with https://github.com/invertase/react-native-firebase + https://github.com/firebase/firebase-admin-node. There is also a web version https://github.com/firebase/firebase-js-sdk. The auth functionality is fully FREE and it's a wonderful developer experience. For AWS there is https://github.com/aws-amplify/amplify-js. I picked Firebase Auth + Storage + Cloud Messaging (and Analytics) over AWS Cognito + S3 + SNS.
+1 for Firebase Auth. Even using AWS Cognito would be better in my opinion. It is another step that you just don't have to worry about and that's exactly what I need
hmm... I think this can work brilliantly if and only if it's laser targeted and very opinionated.
Who's auth problems do you want to solve and what do those people's systems look like?
Auth is complex as hell. Auth libraries are pretty big and hairy with an enormous amount of flexibility. Naturally that's because needs vary extremely widely.
You can't cater to extremely broad needs with an out of the box solution, so there is always a tonne of stuff to implement and in that case using Auth0 or Azure AD whatever makes sense.
But, I totally get the kinda wanting the self hosted version rather than the cloud based solutions. Something you can just drop in and it works is quite nice, but for that to work it has to be pretty opinionated. If it has an opinion that suits a particular use case very well then that could work well.
Yes, that does make sense James. I am looking more towards auth system for web apps and APIs.
I agree, for such a library to work perfectly, it would have to be opinionated. Just like Devise of Ruby.
Thanks a lot for your detailed inputs James 😊😊. What do you use to handle authentication and authorization in your projects?
Depends. Devise when using Ruby is great.
Currently learning .NET core and their auth framework called Identity has a full built in system that's all wired up to do password resets, 2 factor auth and social login. It's even got a default UI that looks somewhat reasonable. So, that isn't a terrible option if you're on .NET core.
It's definitely nice to not have to work so hard on building commodity features.
Wow! Didn't know .NET has such a complete framework to handle auth! Thanks for sharing mate.
I've been using Identity for my last few projects, and I'm really impressed with it too. As @from_30_to_greatness said, it does pretty much everything right of the box. I'll just add that it also creates your database models (which Entity Framework can then use to create your database as well).
Any part you want to change or just see how it works, you can "add scaffolding" for that item, and it'll drop all the views and code related to it into your project.
Here's a.. thing.. I made that uses Identity if you want to see how it looks: https://after-game.net
Yeah, it's fairly batteries included and can handle individual accounts out of the box with minimal effort. It does require a little bit of configuration though. Although that's fairly quick to do, there is still a learning curve to it. I'm actually just finishing up a Pluralsight deep dive course on it which took me a couple of days to work through. The upside is it gets seriously enterprise grade so you'll never be limited in that respect. I dunno, I think it's not a bad trade-off tbh. Though next time I might consider just to use external providers.
Actually you can run your own OAuth microservice in the cloud using IdentityServer4. So it's like having your own private Auth0, Azure AD type thing. I didn't know that existed until playing around with .NET core.
I guess anything takes a little bit of time to learn.
Would be interested in a better way to manage authorisations.
I'm definitely interested in something like this. Currently using Auth0 but I'd rather it be built in to my API.
Awesome Noah. I will ping you on Twitter when the library is published. Stay blessed 😊🙏🏻
👋🏻 PassportJS and nodejs here.
I am curious, what do you believe is wrong with PassportJS? I will say that it took me many, many hours to figure out how to use it. It could use beginner friendly docs but I use it in a dozen node apps of mine great. It works with Express and does what I need it to do.
One thing that I do not enjoy is that is seems to be designed around using sessions by default. I build Restful APIs with PassportJS so I don't use sessions. It is easy to tell PassportJS
session: false, but it's annoying it's built by default to work with sessions.Besides that, I love:
What do you wish it did better that you could build on your own?
Thanks for your detailed reply Levi. I don't think anything is wrong with PassportJS, it's a great library. But I still had to handle the following on my own:
I feel like it gives a solid base, but it's not batteries included. Would love to know some more thoughts of an experienced developer like you on this.
Ah, I see what you are saying.
I do see your pain. It is a pain to repeat this process on your own when you build an app.
From my experience building open source libs and using others, I have found that I personally prefer libraries that are
flexibility > opinionated. However, there are use cases where opinionated libraries can provide tons of great power!I see the pain you are experiencing. There are use cases for opinionated libraries for sure. Have fun building it or finding other solutions that exist already. Thanks for the great discussion!
This comment was deleted 3 years ago
I believe it's optional. For spinning your own OAuth2 strategy, you might but I am not sure because I have never used that provider before. I have only used Google, Facebook, Twitter OAuth2 providers with Passport and those do not require sessions.
This comment was deleted 7 years ago
This comment was deleted 3 years ago
Thanks for mentioning these awesome libraries here. I liked the way Permit works, and Grant has a great coverage for social logins.
I am looking for a more batteries included library in which the developer don't have to write the authentication logic and the user-data fetching logic himself. Moreover, most of the libraries only helps with authentication, the authorization part is entirely left to the developer.
Would love to know your thoughts on this Jean.
This comment was deleted 3 years ago
Hahaha! You described it so well man. 😂 This is exactly what I am thinking.
This comment was deleted 3 years ago
I've worked with JWT once, but not sure I know the term "jwt emission".
It would be awesome to have jwt support for auth, especially for APIs. However, since this is not in my firsthand expertise, I plan to incorporate it later.
How's your experience been with JWT?
This comment was deleted 3 years ago
Oh, okay got it. You use jwt, so maintaining sessions is not required amy more, right? I will get in touch with you for development help. 😊🤘🏻
This comment was deleted 3 years ago
Great! Followed you on twitter. 🤘🏻
Have a blessed day 🙏🏻