What solution do you use for Passwordless authentication?
Hi everyone 👋
I'm looking to setup passwordless authentication for my NextJS and Lambda(Python 2.7) based web application. I'm currently considering Auth0 and Magic.link as both have good guides on how to setup with NextJS. However Auth0's Nextjs library is in experimental state so am leaning more towards magic.link. My backend is Python(2.7) Lambda functions deployed via AWS so would love to know if there is a guide that shows how to use those in cojunction with either library.
Would love to hear your experiences and thoughts!
Magic.link is phenomenal and should be highly considered. No passwords required which is amazing.
It’s a seamless authentication method and your end users will thank you.
I've seen a bunch of options here and haven't loved using Auth0 (which explicitly suggests not to use password login from them, no idea if theirs isn't secure) and Magic.link seemed to limited as they weren't thinking about anything outside a very narrow slice of AuthN. I wrote an article not too long ago about some of the risks with passwordless login if it is done incorrectly.
Additionally neither of these, the last time I checked support WebAuthN, which allows using FIDO2 supported mechanisms like Windows Hello or Biometric login.
I would recommend including social login as it is the most used secure mechanism that currently exists, including all the benefits of MFA.
Additionally for backend, depending on what you need, that may just be verifying a JWT. Here's an example I wrote for the Authress users: authress service authorizer
I know Auth0 was more complicated but there are lots of alternatives and it usually boils down to just that. So depending on what you need, here's article on comparisons of auth products.
Thanks Warren, the articles are super helpful! I'll definitely look into using social login.
Check out nextauth.js
I've used cotter.app for several of my projects. Some of their features include magic login, sms OTP logins, social logins, WebAuthN, and handling of browser sessions. The team is super responsive as well which is always a plus. YMMV
You could use Firebase Anonymous Authentication.
I support IndieAuth on my site, which allows users to login with just their domain name. That said, my users are people with their own domains, and I also have an option for a password based login for people who haven't set up IndieAuth on their domain, so it might not be a good fit for you.
Hi Michael, IndieAuth is really neat and might actually be a great fit as I am building a web analytics tool. Thanks for sharing!
Sounds a good fit. Like I say, not a huge number of people have it set up, so it is unlikely to be your only login option. If it helps, with my current verified users about 47% use IndieAuth and 53% use username + password. But on the plus side, those who have it set up are often quite keen to find another use for it, and there are plenty of open source examples of it in use (including my own:-)
Why not social login?
I wanted to nail down passwordless authentication first as it is the least friction less in my opinion but social is definitely something to consider.
Don't know what's OP's reason is but providers of social logins can refuse you service at any time.
Well, by that logic.
IMO it doesn't work in such a way.
Facebook/Google logins powers thousands of sites/apps. They won't suddenly refuse unless you do something out of their tos (porn, piracy, hate speech etc).
If you still have doubts - there is a way around this.
Let's say suddenly social providers refuse to offer you service. You can implement your own authentication later on if that happens - without losing your old(social logged in users) data.
Because you have mapped users email address as the identification
https://mashable.com/article/parler-amazon-web-hosting-suspended/, Ekhem
That's why you shouldn't depend on AWS, PlayStore and Stripe.
"Facebook/Google logins powers thousands of sites/apps. They won't suddenly refuse unless you do something out of their tos (porn, piracy, hate speech etc)."
No.
They will refuse your site as soon as you become their competitor.
Do you want to learn it hard way?
Tinder has facebook login. Facebook released "Facebook dating" in 2019. And tinder continues to have the facebook login. This is just an example. There are plenty.
"That's why you shouldn't depend on AWS, PlayStore and Stripe"
Good luck implementing your own cloud, payment processor and app store ;)
I guess im gonna learn the hard way.