My Favorite Auth Library is Getting Deprecated

Lucia was definitely the easiest way to set up authentication… until you realize there are breaking changes every 6 months

[@WebDevCody]

How it’s going to work out: our boy Ben Davis is going to make a small npm packaged called Lucia-drizzle-session and we gucci

[@felipejzrd]

Pretty much

[@Scapben]

Didn't you say a while ago on tweeter that Lucia is going to be an other library abandoned in one year? And pilcrow answered "bet" lmao

[@WebDevCody]

@@Scapben oh dang I forgot about that

[@bmdavis419]

I mean like github.com/bmdavis419/create-cyber-app

[@MaxProgramming]

Loved using the library but yeah now without the library it's good to see it's still the perfect guide for simple auth

[@my_yt666]

Back to Auth.js. I've implemented most what Auth.js offers + MFA and session management in a SaaS starter kit called Achromatic.

[@bkschatzki]

Yeah I don't mind this. Working with different auth solutions, it felt like Lucia was a little stuck in the middle. This is probably the best outcome; this is a sustainable identity for Lucia in the long run.

[@chillydill4703]

Interesting, I implemented auth from scratch recently with some ideas from Lucia and it was not hard at all. Of course, you need to spend some time on certain parts as you said but it's really not that hard and I think it's a great learning experience!

[@budivoogt491]

Seconding this experience. Ben, thanks for highlighting that this migration shouldn't be such a deterrent and can actually improve control and sustainability of our implementations.

[@evheniydan]

Can you recommend any resources for getting started with auth from scratch? I just need a reference for, like, what it at least generally looks like.

[@anonanon7368]

The industry is going in the shadcn approach, it's a good thing, no need to download packages, just put code into your code base and use it. I hope he also makes a CLI to easier bring everything into your codebase like shadcn

[@asadsalehumar1011]

Exactly what I've been thinking. I personally liked it, no need to fear the auth, just embrace it.

[@Chenny0]

The writing was on the wall with the deprecation of drizzle and no redis/memcache adapter.

[@tcurdt]

I never understood why the database integeration was done. It really never made much sense. User should just provided functions to e.g. load and store sessions.

[@asadsalehumar1011]

Exactly 💯

[@furycorp]

If you think about it Lucia is mostly its docs and community. An actual auth implementation with Lucia only has a few calls to Lucia-related code itself which is only then a few lines of code. Absolutely everything else was database differences which really isn't the spirit of Lucia. The Internet was and is really missing good guidance on writing auth. Its so bad that modern LLM's trip over themselves and promote horrific practices and provide bad advice -- their training data is lacking. OWASP for all its efforts is so far from it: they pontificate about what to do or what not to do but you don't see any recipes or reference implementations which in practical terms limits their effectiveness and reach.

[@deezydoezeet]

I also like the direction, even though I feel the abstraction was already just right! Love it still!

[@Totomenu]

The only itch I have is that now I have to keep up with the latest security updates. Upgrading packages is not enough to make sure that my auth is running the right ecryption and stuff

[@xyangst]

What do you mean by security updates? Cant rly think of something like that happening recently

[@RemotHuman]

These problems seem to apply to all libraries that need a database to work. I feel like more of these libraries should exist so that everything is like easy lego blocks, but this problem would get in the way. Instead what happens is libraries host the database and servers for you and then charge you as SaaS products. But I like libraries more as there’s more control and they are generally free.

[@abdulrafay1951]

there's new one, better-auth the guy is developing it like a maniac do check it out and contribute as he's alone.

[@derproka]

Yeah I saw… this is a bit sad for since now I’ll have to write a bit more code but hey, it’s no big problem.

[@sukontoraharjo6565]

Didn't know jack harlow was chill like that 😂

[@reversetcp]

mane same, feeling. it took me a few days to take it in but ig its a good thing

[@bmdavis419]

Its been trending this way for a while, kinda a bummer but I totally get why hes doing it

[@Caldaron]

knowing what you're using is kinda neat ngl ;-)

[@IkraamDev]

I agree, at least this will help developers understand authentication better.

[@arvi8843]

Thanks for the update! I was considering this then found this video. 😅 What do you think of Workos or Eartho?

[@labdo_]

Better-auth could be a good alternative, it has a higher level of abstraction than lucia and offer more features. But it's still in beta tho.

[@realitydesigners]

I’m so glad I never hopped on this wave

Kinda wished he just introduced some callbacks for creating/deleting the sessions and let users handle the storage layer, but I get his point. After you remove the adapters, there isn't a lot of value between that and just managing the sessions yourself.

[@tsykin]

Have you tried using auth solution that actually uses callbacks without creating callback hell? I am experienced massive callback hell when using NextAuth and never coming back

[@JEsterCW]

​@@tsykin auth.js is so freakin bad and problematic, i swear

[@Totomenu]

Yes! and then a good forum so people can share the schema and functions for each db. I'm pretty sure that in a couple of weeks they would cover almost all databases with 0 work from their part

[@notnotjake]

I think this is great. also what I think rails is starting in rails 8 based on dhh's keynote

[@fus3n]

Then isnt maintaining as an individual who implemented following the tutorial also cumbersome? I don't wanna sound unthankful that thede tools are already free and open source but, Isn't that sometimes the reason people choose libraries over manually writing?

[@gryg666]

It's good to learn it once, but then for every other project implementing it from scratch... nah..

[@NabekenProG87]

You can just copy the implementation from another of your projects. It's literally just 1 file with 4 functions ...

[@tsykin]

Idk about you, but I am planning to use this new guide to roll auth with olso and arctic. What about you?

[@paca3107]

only I is using own auth built from scratch?

[@mostrealtutu]

lol, js libraries getting deprecated, who would have thunk

[@prashlovessamosa]

Now we have Better-auth 😅 are there any js fullstack frameworks has its own auth support out of the box apart from adonis JS I think we need something like laravel.

[@peteredmonds1712]

javascript moment

[@semyaza555]

Honestly, this is why I just use mature, stable ecosystems on the backend, i.e. Python/Django, Ruby/Rails, etc. JS is the only ecosystem where the libraries behind core app features (Auth, ORM, Module bundlers, etc) change every other year.

[@arthuraguiar5382]

yeah... the fact that people need to use external libraries for something as fundamental as authentication that should be baked in (as it is with Laravel, for example) always bugs me

[@muneebakram1670]

NestJs is pretty stable and very well maintained in JS ecosystem

[@semyaza555]

⁠@@muneebakram1670 I like Nest , it’s a great starting point, but the community is still growing, and adoption isn’t as wide as it should be. It kinda reminds me of Koa tbh. Edit: It reminds of Koa in the sense that Koa was a great alternative to Express but just died on the vine.

[@ProtectedClassTest]

With emphasis on CORE features.. js cult has been solving nonexistent problems all along

[@jeffreysmith9837]

​@@muneebakram1670Nest doesn't have auth. Its just a DI container that pretends to be a framework by pulling in 10 other 3rd party libraries

[@tran_hai_dg]

Can you tell which font do you use for your VSCode?

[@bmdavis419]

Geist, the vercel font

[@dgcp354]

have you tried better-auth

[@codingwithjamal]

enjoyed the video

[@edhahaz]

shadcn of auth

[@MengLinMaker]

The root issue is wanting supertool library that does everything auth related. Supporting everything is probably impossible. In contrary, primitives like Artic and Oslo are more compostable and not coupled to dbs and orms.

[@azizsafudin]

Exactly, this is a good balance. Provide quality primitives and good docs for best practices and be done with it.

[@qo7ems]

roll your own auth!

[@azizsafudin]

And not have it adequately secure? Sure.

[@qo7ems]

@@azizsafudin did u not watch the video

[@mrkostya008]

roll your own auth brudda

[@djordje1999]

Yeaa, i seen people paying for comments on their projects like they can't make it themselfs...

[@semyaza555]

@@djordje1999people pay for comment sections??

[@DarkDunkelheit]

yo wtf why, lucia is amazing, next auth is so opinionated and a hassle to work with,

[@liamkearn]

JavaScript ahhh video.

[@mr.random8447]

I’m raging right now

[@grimm_gen]

Supabase auth is supa easy to set up

[@hrqmonteiro]

Let's be honest, EVERYBODY knew that was happening. No one uses it lol People in the ecossystem use AuthJS (former NextAuth) or something written from scratch.

[@perc-ai]

Ben we tried to warn you. Stop using these silly startup auth providers. Just learn AWS / GC for the love of all good things.

[@hasan5984]

Which service should I learn to do things that I do with Lucia

[@bmdavis419]

Already migrated off to custom auth lol

[@konrad2431]

You mean Amazon Cognito?

[@hasan5984]

@@bmdavis419 how?