Ask HN: What do you use to build auth?
I too have seen the articles proclaiming that devs should stop implementing auth themselves and instead use some Auth as a service product. After all Authentication is hard to get right, right? Actually the basics are really easy. Using a short-term JWT and bcrypt to salt passwords is like maybe 10 lines of code. The thing is, most of the truly hard Auth problems I&#x27;ve had to solve in my career took a highly custom approach anyway.<p>I suspect most people use products like Auth0, not because they are trying to solve those hard problems, but more likely, because it&#x27;s easy to set up and comforting to hand off that segment to a company that says they are battle-tested and secure, etc.<p>I personally like writing my own Auth because I can cater to my personal level of paranoia and learn more. Maybe I&#x27;m weird in that way, that I like to consider questions like, how short-lived should my token be? Should I issue a new token on every request? Local Storage vs cookie? Should I use a one-time token? Should I store the JWT in memory only on the client? How would I invalidate a user&#x27;s token at will?<p>There&#x27;s lots of interesting questions beyond the basics for sure and I can see how that might be intimidating. Most projects only need the basics though. And if you need more, it might be easier to extend your own implementation rather than some use-case not catered to by a library or service.<p>At the very least, I think it&#x27;s wise for dev&#x27;s to experience writing their own Auth a few times to get a grasp of some the challenges and better understand what those services might be doing for them.