Lucia Auth is Getting Deprecated

Рет қаралды 12,472

Күн бұрын

Пікірлер: 83

@rodjenihm Ай бұрын

Lucia is basically one-man project of 19 year old college kid. We did not want to roll our own auth so we let a teenager do it for us.

@gustavocadev Ай бұрын

he's 20

@MrJfergs Ай бұрын

pretty funny and indicative of the JS ecosystem, it's either a big VC backed company that is essentially closed source or like 1 overwhelmed guy. Seems like we need a healthy middle ground?

@malcolmn.5222 Ай бұрын

@@MrJfergs it takes time to build and maintain this stuff, it's not cheap or free.

@MrJfergs Ай бұрын

@@malcolmn.5222 yeah that's fair, not blaming anyone who doesn't want to work on open source all the time. Just think a healthy middle ground is best. If you think about the rails or laravel eco system these have some of the best characteristic of open source and private companies IMO. Since there is no centralized batteries included framework in the JS ecosystem it seems that we have either extreme? Auth.js should be better as well as passport.

@virtual5754 Ай бұрын

He created it for himself basically, because he found that all other solutions sucked for his project. Now he deprecates it because it sucks for his projects.

@Distortie Ай бұрын

Did you find your tweet from 1yr ago where you commented on how Lucia auth was going to be just another depreciated package LOL

@WebDevCody Ай бұрын

yup, I reposted that tweet, but I didn't want to bring it up on youtube

@mungaibrian2940 Ай бұрын

@WebDevCody I can respect that

@greyshopleskin2315 Ай бұрын

A web dev advising to use as lead dependencies as possible. I now have hope in this industry

@yiannis_p Ай бұрын

This is honestly great news as this allows anyone to implement auth safely as the core security packages are still maintained (Oslo and arctic). This approach is based because it allows you to tailor it to your exact needs. With most other frameworks if you dare to have any business needs that are not part of the “plan” the framework fights you every step of the way.

@o_glethorpe Ай бұрын

Having to do more work than you planned is never good news

@yiannis_p Ай бұрын

@@o_glethorpe if you think the importance of auth, spending 15 minutes to refactor your app so it uses one less dependency while helping you truly understand what’s going on under the hood is a great trade off imo

@yiannis_p Ай бұрын

@@o_glethorpeSpending 15 minutes for authentication is totally fine. This allows you to now depend on one less dependency while expanding your understanding of what’s going under the hood. Overall that’s a good trade off for me.

@Ss-zg3yj Ай бұрын

What will you write when he deprecates Oslo and Arctic next?

@yiannis_p Ай бұрын

@@Ss-zg3yj your sense of entitlement over other peoples work is honestly alarming pal. If you are scared he will deprecate those as well, implement them yourself, find other packages or pay for a company. Don’t complain that others aren’t doing your job for you to the level that you want.

@braincel05 Ай бұрын

i cant believe it vps, roll your own auth, roll your own DB ben awad was right all along @bawad

@2breezy866 Ай бұрын

Based Awad

@MrJfergs Ай бұрын

seems like cody is using convex most of the time so I am not sure if he really agrees?

@afrodyzjak7377 Ай бұрын

Whats the problem? Like rolling your own auth is like 1hour right now using docs from lucia? Vps is also not hard to do. But if u are slacker thats the problem. LOL

@SeibertSwirl Ай бұрын

Good job babe!!!!!! Love ya!

@jd_27 Ай бұрын

I'm also in the same boat of rolling my own auth, I made an auth API using express which I can reuse for any of my side project SPAs. It just sits there ready to use when I need it and I don't have to worry about it

@hehimselfishim Ай бұрын

made an express app like that, too lazy to take out the auth and make it standalone, but i think it’s probably the best way to handle these kind of scenarios with packages deprecating everyday.

@BarakAlmog Ай бұрын

You're doing god's work. Over the past year or two I went round-robin on virtually all main authentication approaches - Firebase, Clerk, Next-Auth, Convex-Auth - trying to force each to act exactly the way I need, giving up, jumping to the next one,... a vicious (downward?) spiral. Turns out that once you understand the mechanics of it, it's really the best approach just to take care of it all yourself. The WDC Starter kit is awesome. I understand a large portion of it just by combing through the repo. I'll definitely purchase the Gumroad version also. Can't appreciate you enough, Cody :) What would we do without you...

@WebDevCody Ай бұрын

Thanks man!

@BarakAlmog Ай бұрын

Ofc :) Just advertised your starter kit (& Gumroad product) in one of my local dev whatsapp groups. The world need to know ... :) Just doing my part. Thanks plenty also 🙏

@nasko235679 Ай бұрын

I don't know if this is an unpopular opinion or not, but rolling your own auth is not that hard. And you can do it once and reuse the boilerplate code multiple times. Just seems like companies that want to sell us services have scared us away from doing anything remotely security related, like deploying to our own servers and rolling our own auth so we can pay them to do what's been considered our job for decades.

@arvi8843 Ай бұрын

Not when an enterprise needs a more complicated auth like 2FA, biometrics, etc. For hobby projects... sure. Go with username and password. For others, there's Eartho and WorkOs Authkit that offers this for free.

@rand0mtv660 Ай бұрын

I think "rolling your own auth" means different things to different people. Some think it means doing everything from scratch like encryption, encoding/decoding etc. while others think about the session management part and DB related stuff that you build on top of all that low level work. I would never do everything from scratch, but yeah just doing session management and creating users in a DB isn't that scary as long as you are using some trusted libraries to do all of that security related work. And I think this problem is actually specific to JS ecosystem that these things are so heavily delegated to 3rd party services. Frameworks like Laravel (PHP) and .NET (C#) have authentication baked into the framework and people using those aren't afraid of auth work at all. Even WordPress comes with auth out of the box and I haven't seen people use a 3rd party service there for auth.

@rand0mtv660 Ай бұрын

I love to do this for UI components. Even though I might use a UI component in a single place, I still do my own custom wrapper around it. Saved me many times. There are components you use in a single place initially, but end up being used in a lot of places in the end anyway. I had to move off some deprecated UI components in the past and I ended up just updating the underlying implementation while leaving the custom wrapper API intact and that makes for a super easy migration to something new. I also like to do that with date formatting for example. If for some reason I have to switch from date-fns for example to dayjs, I won't have to do bunch of updates around the codebase, but just update utility functions.

@braincel05 Ай бұрын

fire tips as always, thanks cody!

@rayhankessal6976 Ай бұрын

Nice vid Cody, have you ever used Redis to store sessions instead of your database?

@EdwardOrnelas Ай бұрын

Wow, Thank God I didn't integrate it with a Healthcare Application I was working on earlier this year. Rolling your own Auth seems to be the move nowadays. I did that in a current project I'm working with and its not as much of a headache as everyone made it out to be.

@icestonks2555 Ай бұрын

Thank God? Did you not see the video, and how easy it was to switch from it? If you had used Lucia, you would've spent a couple of hours, maybe less switching from it. No big deal

@EdwardOrnelas Ай бұрын

@@icestonks2555 The app has 10,000+ users with a complex infra. It had 3 applications. One for Agencies, Healthcare workers, and clients. Authentication plus Authorization that had to be logged into the DB which was also replicated onto another database. Nothing about it was simple.

@emanuelturis4132 Ай бұрын

Oh no! Now we need to learn to implement auth it's the end of the world as we know it!

@albinopepegas8391 Ай бұрын

Hopefully drizzle doesn’t get deprecated

@WebDevCody Ай бұрын

I mean, it's maintained by a core team living in a war zone

@developer217 Ай бұрын

@@WebDevCody not really a war zone tbh

@MrJfergs Ай бұрын

@@developer217 they have rolling blackouts and need back up generators to use their computers reliably. Sure they're not getting shot at while coding but I think living in a country that is being invaded means you are in a potential war zone.

@d123-o8j Ай бұрын

I love Clerk combined with Stripe and webhooks direct to the server for most SaaS projects where I don't anticipate more than a 1k users. If I was expecting 5k users I'd be looking at boiler plating my own auth though because clerk charge some serious £££ When I say boiler plating, I'm sure you'd still be able to use some existing libraries for it so you can stay compliant with Google sign in etc.. Just becomes a bit more effort think about cookie manipulation, and csrf attacks, database storage...

@NightstalkerKK Ай бұрын

Or just don't use packages that are maintained by one person?

@PraiseYeezus Ай бұрын

I don't understand why the library creator doesn't just allow us to pass in functions that interact with our database ourselves, if they don't want to maintain database adapters. Are type inconsistencies that bad that the entire library needs to be deprecated? I also don't understand why people seem to be upset/concerned when the library was so minimal and was mostly just copy/pasting come code snippets.

@theLowestPointInMyLife Ай бұрын

you only need to roll your own auth once, then you have it for every project, people forget that

@mandarliev Ай бұрын

Nevertheless, I liked the article of pilcrow about not relying on middleware. He has a point there :)

@dave3269 Ай бұрын

Supabase is too cheap to do all this extra work fr maybe one day 😂

@malcolmn.5222 Ай бұрын

Depending on the complexity, scale and focus of your project, rolling your own auth could be worth it.

@Realswagoverlord Ай бұрын

Another reason I try not to use a third party package for everything.

@sarabwt Ай бұрын

We are moving towards CVE-less world rofl

@TozzaYT Ай бұрын

Have you pushed your changes to the repo?

@WebDevCody Ай бұрын

Yeah, I’m pretty sure I have

@micelumail5829 Ай бұрын

Cody, what do you think about better-auth?

@WebDevCody Ай бұрын

I never used it

@PhillipLippi Ай бұрын

That's why aí don't like depending on third libs for authentication. I aleady have a boilerplate, so I do once

@vaibhav5783 Ай бұрын

If you don't mind, could you share it?

@jeremyAr Ай бұрын

Hey cody since lucia auth is deprecated how about a tutorial on implementing your own auth in nextjs? Would love to see how you do it. Cheers!

@tylerw4496 Ай бұрын

this is the worse news since my grandmother died

@twitchizle Ай бұрын

🎉

@mazharansari7813 Ай бұрын

Bro what ☠️

@PeterSahanaya Ай бұрын

dude..

@developedbyed Ай бұрын

Damn grandma got deprecated as well 💀

@tylerw4496 Ай бұрын

@@developedbyed too soon

@TheRoseWoodBody Ай бұрын

we're toast if lodash goes down

@pawepyc239 Ай бұрын

I migrated to v3 a month ago :(

@Gaammee_Media 27 күн бұрын

Try Better Auth. It's really amazing

@dreamsachiever212 Ай бұрын

I don"t know if I should type "LOL" or just "L". Glad I never got interested in this package even when it was getting promoted by many...

@LuisMartinezSuarez-t3r Ай бұрын

oh man how am I supposed to implement auth

@amosmachora Ай бұрын

wow. So someone from across the earth can just yoink their project and people can do like nothing about it. Cant someone create a fork or something?

@danielharten4890 Ай бұрын

Go for it, let us know how it goes maybe we can use your Auth library next

@k00k Ай бұрын

Yeah, someone can create a fork. Or, you as a user can just save a local copy and use that. The problem with both of those scenarios is that in a year or 10 from now when someone finds an exploit in one of the methods, you are now down a long and winding road with monsters. If the library was not deprecated, the maintainer would hopefully put out a fix, you'd update your npm and be good to go. But when you're on your own, now that's on you. In a lot of domains this isn't a big issue, but in auth and security, it's a much greater concern for obvious reasons. This is why people say, "auth is hard." And it's why so many people are using things like Clerk.

@WebDevCody Ай бұрын

yeah, I mean anyone can fork it and rebrand the name of the library, but the library pretty minimal that just copy + pasting the code isn't that hard to do.