How much time should I plan to integrate Token-Based security in my application
How much time can be expected to integrate security in my app. Does anyone have experience in the time taken to implement & maintain a token-based authentication framework? (just looking for a rough idea)
It depends, if you are using one of these authN solutions then a couple of hours.
If you are planning on writing it yourself, then a couple of weeks.
This is an awesome link! thanks for sharing this, I will definitely be able to find a solution that fits given these options :)
Hello. Are you looking for passwordless or password-based? Do you need "embedded" (you managed the auth flows" or "federated" (outsource to 3rd party" solution?
In fact I am working on my own Passwordless Platform and I can help you implement the solution very quickly. We have all flavors of passwordless (one-click, biometric, QR code). You choose. For instance here is our JS guide https://blog.idemeum.com/passwordless-in-10-minutes-idemeum-javascript-sdk/
Let me know if you need any help.
Here you can see an example of a token based authentication (made with Ruby on Rails for the backend and Svelte JS for the frontend):
https://github.com/jorgegorka/demanda
Cool thanks for sharing going to have a look.
It depends on how sophisticated you want your authentication system to be.
Issuing a token and passing it between client and server is not difficult, but if you want to include more advanced security features and properly pen-test your application then you're looking at 1-2 weeks of time to do it properly.
I'd suggest using a boilerplate or a third-party auth service for this if you want to save time, it's a lot of hassle for a feature that your users will find trivial :)
Thank you! It seems there is quite some complexity in having a robust authentication system & being able to pass a pen-test would be the ideal state for me. I will definitely take your advice and look at using some of the great resources in this comment section.
It gets very complex very quickly, I've just spent over a week adding social logins in my boilerplate, all the other auth functionality easily took at least a month of work to get right and test :)
I can explain how much time it took to integrate https://aws.amazon.com/cognito but I'm not sure that's what you are asking. Are you trying to build a framework from scratch or integrate one?
Thanks for sharing disrael. I have been exploring the frameworks & given the useful responses, I will be looking at integrating one. (Building one from scratch might not be the best for me) So I would be super grateful to hear how long it took you to integrate aws cognito?
We are using AWS Cognito for identity only. So a person identifies himself via Google or GitHub login or email address and password and Cognito gives us a token. The token Cognito gives out is used as proof of identity to get back a Uclusion token giving specific rights.
There was a steep learning curve on all of the above and we ended up tinkering off and on for months to get it right. However the Javascript package that Cognito uses, Amplify, is also a good message bus and that was helpful across the UI.
We also considered https://firebase.google.com/docs/auth but since we are on AWS for everything else didn't go for it.
If your question is really could someone build an Indie project that we would use instead of Cognito then yes - we even talked to Indie Hackers trying such a thing but were not able to find anyone serious.
I have been working for the past year on a solution to facilitate integration for identity providers (and more). It's been a long journey but now I can say that the solution is quit stable and also used by a few companies already. I would be happy to have a chat in private if that's something that sounds interesting to you.
You can always get on my calendar via the walkthrough link on Uclusion but its too late for us to rip out Cognito at this point.