Ask HN: What type of Auth are you using on your side projects?
I was looking at the Supabase docs and it was nice to see a long list of Auth work flows supported/documented. So my question is, here in October 2024, what are y'all using for Auth on your side projects. Password based, social, email, something else? If you are using social, which social do you support? Is there any public data on which types of Auth have the best conversion/bounce rates? And for you, which Auth is just easy to support long term and which just ends up being a drag? TY
This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots:
- Be able to store two types of tokens, one that is temporary, and one that is "permanent"
- Users can use their email address to get sent a temporary token (which expires if unused after X minutes)
- Users can click that link to change the temporary token for a "permanent" token they (the frontend) can use for authentication
- Clicking "Logout" invalidates the currently used "permanent" token
Biggest issue is making sure that whatever email provider you use for the "Login Emails" consistently sends emails quickly, as there is nothing worse but sitting for 2-3 minutes waiting for a login email because the provider batches sends or something.
This would specifically be for side projects. If it grows beyond that, you really should implement something with proper rotation and more, but there are tons of resources about that out there.
I've been in big tech and out of touch with the real world for a while, and I started a project only a couple of weeks ago to get a feel for what the cool kids are doing in web dev in 2024. So I can't claim any deep authority or experience with a lot of different approaches. But I picked Clerk because it was in a tutorial, and so far so good. It couldn't have been much easier, and the free tier seems more than generous enough to get through the prototype stage.
My main concern is that I don't want to weld too much of my design to any one service provider, so I've got to be careful about taking too much advantage of their feature set and API so that it won't be a pain if they go away or it becomes necessary to migrate to something else.
In my latest side project I am allowing people to start using the tool without signing up. You can see it working on sandbox.wasitsent.com.
I am using Django’s user system. When a user comes and wants to use the app, I create a Django user and mark it as auto-created. Later, when they decide to sign up, I fill the details and I mark it as auto-created.
Using password auth for now. Will migrate to auth0 if enterprise customers knock on the door and want SAML.
For admin panels, I use SSH port forwarding, as no additional configuration is needed for that. For users, I use email invite codes that contain the hash of the server’s public key and are pasted into a stand-alone client. That way, I don't need to maintain TLS certificates.
Amazon Cognito. If I ever scale past a handful of users and it starts costing money I'll revisit but for a side project? Auth is the least interesting part and I just want it to work securely with no fuss.
HN post: https://news.ycombinator.com/item?id=41738273
- Be able to store two types of tokens, one that is temporary, and one that is "permanent"
- Users can use their email address to get sent a temporary token (which expires if unused after X minutes)
- Users can click that link to change the temporary token for a "permanent" token they (the frontend) can use for authentication
- Clicking "Logout" invalidates the currently used "permanent" token
Biggest issue is making sure that whatever email provider you use for the "Login Emails" consistently sends emails quickly, as there is nothing worse but sitting for 2-3 minutes waiting for a login email because the provider batches sends or something.
This would specifically be for side projects. If it grows beyond that, you really should implement something with proper rotation and more, but there are tons of resources about that out there.
My main concern is that I don't want to weld too much of my design to any one service provider, so I've got to be careful about taking too much advantage of their feature set and API so that it won't be a pain if they go away or it becomes necessary to migrate to something else.
I am using Django’s user system. When a user comes and wants to use the app, I create a Django user and mark it as auto-created. Later, when they decide to sign up, I fill the details and I mark it as auto-created.
Using password auth for now. Will migrate to auth0 if enterprise customers knock on the door and want SAML.
Supported providers: https://authjs.dev/getting-started/providers/github
It's been really great so far and I can recommend it if you have a JS/TS codebase.
----------------------------
You can test Auth.js (v5 beta.22) in my Next.js 15 boilerplate:
https://achromatic.dev
• Credentials auth
• Google and Microsoft login
• Connected accounts
• Multi-factor authentication (via authenticator app)
• Session management
[1]: https://kanidm.com/
[2]: https://authzed.com/docs/spicedb/getting-started/discovering...
This is live at https://screenrun.app/
For selfhosting Authentik + Traefik forward auth is a unbeatable combo
However, for my smaller personal side projects I rely on a simple JWT auth based on JWT, QR-codes and https-only AS secure AS possible cookies.
I plan to try openid but i did not habe the time yet.
If you have a userbase, a local username/password login should be at least an Option...
For admin, I use HTTP basic auth like the boomer I strive to be.