It&#x27;s simple to write a password-based auth system. Then you must clear session appropriately.<p>Then you must create the login page.<p>Then the controller for authenticating. And then you need to ensure that the flow works with a test.<p>Then you need the email that actually activates the account, with the activation hash. So now you&#x27;re setting up a mailer system, which Phoenix does not have by default.<p>Then people will want to recover passwords. So you need to write the logic for that. Oh, and the controllers and views. And routes.<p>And of course, you need to hash the password using some kind of encryption. Excrypt, comeonin, what have you. Choices choices choices.<p>You&#x27;ll need a plug to act as the bouncer for your routes too, so nobody gets in where they shouldn&#x27;t. So you&#x27;ll have to write that.<p>You have to end-to-end test this, of course. And probably, if your business depends on it, get a couple other people to review the security of your system.<p>Simple. And takes a long time.<p>HTTP is pretty simple, but we use frameworks. SQL is pretty simple too, but we use Ecto now.<p>It&#x27;s simple in its pieces, but I really don&#x27;t wanna do all that work on every app. I&#x27;m lazy.