The State of Authentication

[@thrash1337]

Stop telling people auth is hard. Most need a session cookie with a db lookup. You make it sound like everyone is rolling out their Stripe. Jee, I wonder what Auth provider they used? Oh that’s right - they crossed that bridge when they got to it.

[@Bu7MaiD075]

this. Everyone made auth sound so hard until i decide to roll my own.

[@_tr11]

​@@Bu7MaiD075don't to this. try implementing hashing, salting, 2fa, mfa, oauth, sso, session management, webauthn, password reset, and magic links all without a single vulnerability.

[@Kitulous]

@@Bu7MaiD075 and then your db gets leaked and users' passwords are all over the internet

[@residentsleeper387]

Fully agree, they will write articles how implementing your own auth is difficult and even if you do it yourself it won’t be tested as good as their so don’t even bother doing it and buy their product right away. Basic backend knowledge, JWT, bcrypt and that’s it

[@11WicToR11]

there is very narrow bridge between that imho, the moment you want dashboard the complexity explodes and its nice to have option to just let completely different team handle that part. I m currently part of very small startup and having entire block of issues off-loaded to other guys (that do it for free until they charge amount that is laughable compared to other costs you have - team salaries) it makes a difference between surviving and not and we do these decisions daily ...and when needed you can always make your own service to replace it

[@NotAllHeroesWearCapes-101]

I recently moved from authjs to betterAuth .. and it is a game changer. Super easy to use. Absolutely hate Clerk pricing and lack of control on data. Authjs had multiple issues, including cant use it in expo. BetterAuth works smoothly

[@invinciblemode]

I moved from clerk to better auth too. It’s much better. It’s what Lucia almost was…

[@harshitpant07]

oh so true authjs bring a lot of pain while working with and to top it off no proper docs

[@ahmedhassan_saver]

It requires a database to store the user, what if i have my own separate backend?

[@paw565]

​@@ahmedhassan_saverthen it is a no go and you have to stick with auth.js

[@australianman8566]

Don’t fall for the trap, homies. Clerk sounds all good at first, making everything seem easy, but they’re locking you in. You’re handing them unnecessary access for something that could easily be handled with an open-source, non-locking tool. And if, for any reason, they decide to kick you out for not following some weird rule, say goodbye to all those users you’ve busted your ass to acquire. They throw a ton of ads at people just starting their careers to convince them that auth is some complex thing that only “experts” can handle. Nah. Do. NOT. FALL. FOR. THEIR. TRAP. Go full OSS! Also, keep in mind Clerk can jack up their fees whenever they feel like it. And sure, 2 cents per MAU might sound okay, but once you hit 100,000 users, that’s $2,000 you’re paying them every month.

[@impc-lx9gf]

Agreed! I’m not sure why @theo is promoting Clerk so strongly without discussing the drawbacks of third-party auth providers.

[@RhysSullivan]

If your product has 100,000 signed in MAU and you’re not making significantly more than $2k/mo you’re doing something wrong

[@PraiseYeezus]

"They throw a ton of ads at people just starting their careers to convince them that auth is some complex thing that only “experts” can handle." I would never use Clerk for a project I was serious about, but...wow. Anyone who says that authentication is easy in these convos is confused about the point: AUTHENTICATION is easy, AUTHORIZATION is hard. Different compliance layers, fine-grained permissions, identity reconciliation, security, these are all things that come into play. And if your project gets to the point that you have 100k users, having to pay $20k for a security audit and failing because you made a small mistake is much, much more expensive than paying $2k monthly for a likely-profitable business. I'm genuinely trying to not sound like a jerk but it just grinds my gears when people try to create villains in this type of thing...complex problems = people will make money from solving it.

[@_tr11]

​@@RhysSullivanI've had an app that reached 100 000+ unique users and I wasn't making any money with it. there wasn't a way to make money with it too

[@impc-lx9gf]

Oh, don’t worry-Theo’s followers won’t throw you away. They’ll even defend you! Unless, of course, you dare not use Clerk-then they’ll tear you apart. But hey, my comment got deleted, so will your. 😂😂😂😂😂😂

[@melodyclue]

I love better-auth because it's free and totally customisable.

[@technerd3455]

I've never used any other authentication library since discovering Better Auth.

[@ahmedhassan_saver]

It requires a database to store the user, what if i have my own separate backend ?

[@rahilansari261]

Then use a httponly cookie

[@4v4]

so this is basically a clerk ad?

[@adrian110288]

He said himself, he's gotta pay the bills

[@AbstruseJoker]

Auth is hard, but vendor lock in for auth is not a good idea

[@robimez]

better auth mentioned lets GOOOOOO !!!

[@nathnaelwondisha6649]

robiiii

[@yohannestz9893]

Ethiopia mentioned

[@Samuel_Fikre]

Better auth is the only option

[@thekj_script1311]

Better auth is simply just better

[@AjayCoding]

BetterAuth is great

[@fetehadinnegash]

BetterAuth= Better-life🎉

[@chinesesparrows]

≠BetterHelp

[@SeanCassiere]

An important note about Lucia. Pilcrow is no longer using Lucia for auth, rather he's using another lib he wrote named "Arctic" that exports the right helpers for building your auth solution.

[@jermunitz3020]

@@SeanCassiere Thanks I will check it out. Simplewebauthn was a great library for passkeys. He said he regrets an auth Lucia touching databases as it's too complicated to please everyone. You call a library while a framework calls you. Big different

[@silentiumestaureum]

No mention of Kinde ?

[@bzbetty1]

hopefully once they release the payment side of things it'll get a bit more attention. that said I'd love them to bring out a bunch of components (like clerk) for user management.

[@nicolasherve7853]

Access/refresh token vs JWT part is not correct. Access tokens can be JWT, and storing them in cookies vs local storage has nothing to do with it.

[@jermunitz3020]

I roll my own. No vendor lock in. It's not that hard. Edit: Auth0, Okta, Clerk etc want you to think it's hard! With some helper libraries for crypto and oauth flows it's a few days work tops. It's too risky to outsource such a core infrastructure to some party who might hold you hostage.

[@mr.random8447]

You have every project implementing auth their way. Such a bad idea. And when you have any substantial app and get audited and they hear you doing your own auth…lol. You have 2Fa? Multi tenant support? Library is best bet. Standardization and delegating concern to lib

[@natedunn3933]

I find this over generalization unhelpful. Auth is easy to start, but hard to master. Ask library maintainers, and SaaS companies alike. All the edge cases, security concerns, and surface areas to cover can make a simple thing complex very quickly.

[@mr.random8447]

@@natedunn3933 this, if you aren’t building a toy app, rolling your own auth is a massive mistake

[@user-wn2ho5ij5f]

Have not asked yourself why even massive companies out source with??? “Not that hard” to get your company hacked

[@Aristotle675]

Just the business logic and corresponding UX alone that comes with dealing with oauth is a huge time sink. What happens when a user signs in with an oauth identity with an unverified email address that matches an existing accounts email address? I’ve rolled my own before, never again.

[@norbi4148]

Keycloak? I’m in the banking industry and it is honestly not bad. I use it on my side projects as well.

[@this.tushar]

Keyclock is very popular in java community

[@GuiChaguri]

Same here! Using one of these newer solutions in banking sound risky considering Keycloak is 10 years old, has a lot of funding, and it still has many security vulnerabilities being discovered every single month.

[@Smultar]

I've also moved from authjs to better-auth. It's just been so much easier to work with. Documentation just makes sense.

[@PetrasBaukys]

JWT explanation misses the point here. It has nothing to do with storing auth data in localStorage (in fact you should never store sensitive data in localStorage) . JWT strengths is that the data is digitally signed in the server and can be verified only there. In other words it's readable by everyone who get access to the token, but can only be verified that it's legit on the issuer who posses the encryption key. And JWT can be stored in cookies as well.

[@_tr11]

why shouldn't you store sensitive data in LocalStorage?

[@SaberKarmous]

Jwt doesn’t need to be signed. Can be signed AND can be encrypted. And if you’d use oauth, you can get the JWKS (json web key sets) through GET /.well-known/openid-configuration. Which gives you access to public keys which you can use yo verify the signed jwt.

[@phendan]

@@_tr11 Because localStorage can be accessed from within JS, meaning it's vulnerable to XSS attacks. You should use http-only cookies for session data.

[@florind7056]

@@_tr11 Local storage should not be used to store sensitive information like user IDs, session tokens, personal information, credit card details, or API keys. Its lack of encryption, vulnerability to XSS attacks, and lack of access control make it a risky place for sensitive data

[@nicolasherve7853]

Any JavaScript code running on your app would have access to it.

[@KiflomBerihu]

betterAuth is better

[@_tr11]

betterauth supremacy

[@_ulghun]

Auth is hard Me: php artisan breeze:install

[@mr.random8447]

And you have no knowledge of auth. What I have noticed is that any full app framework with lots of magic are poverty devs cause everything is done from them.

[@_ulghun]

@mr.random8447 Because I have some knowledge of authentication, I didn’t want to pay for authentication with SaaS, so I just used Laravel to get the job done quickly

[@dayne-kora2415]

​@mr.random8447 what do you suggest?

[@404-not-found-service]

Me gusta que dejes claros los sponsors y también conocer puntos de vista en estos temas, sigue asi

[@DagmfreSeid]

Better way to auth: Better Auth

[@Ali-Aljufairi]

Thank you I was so lost betwween them all and was not sure which to choose over which thank you for doing the reasech on my behalf and given me summary

[@CodexScriba]

I'm surprised not to hear Supabase. Easier to set up, more generous free tier, but something very important that was not mentioned, it supports both next and react native. So, it kind of covers it all.

[@alank764]

What about Auth0? I feel like It has spot in this

[@paw565]

It's a bit pricey

[@vaisakh_km]

Just now i gone through the nightmare of custom auth in Spring security... it's not even an hour yet, you are already giving me PTSD

[@ooijaz6063]

Feel you bro, tbh it's much easier to skip spring security and implement you own using AOP, you can create @Authenticated annotation for method or class

[@jamo8334]

Epic video mate. Literally couldn’t have come at a better time for me!

[@domephant]

How about keycloak? Isn't it a similar, but really mature alternative to openauth?

[@paw565]

Keycloak is oauth provider and openauth is library for implementing auth patterns for you. You can use it to store users in your db and in the same time configure login with keycloak.

[@guillaumeclimentygarcia8143]

we use it at work and I found the login screen of keycloak sooo ugly😢

[@paw565]

@@guillaumeclimentygarcia8143 you can easily customize. They have custom themes and all this stuff.

[@domephant]

@@guillaumeclimentygarcia8143 it isn't a beauty, but you can style it a bit

[@paw565]

@@guillaumeclimentygarcia8143 you can customize it, they have custom themes

[@omersoncruz1081]

Finally a topic about auth libraries availble for react. Thanks Theo

[@raiyansarker]

it felt like your investment ad.

[@nicolasherve7853]

If you want to host your own OAuth provider, I would recommend using node oidc-provider library that is openid connect certified instead of openauth that is still in beta and does not implement all the oauth 2.0 / openid connect specs.

[@NizzyABI]

can’t wait to watch this

[@kocokan]

One more state storage: session id in cookies

[@phendan]

http-only, secure-only cookies 👍🏻

[@pranavgoel29]

How would you suggest or do the auth if you are not using nextjs, instead you have api and react frontend let say.. nowadays people don't event mention these and go to nextjs fullstack sols..

[@paw565]

It depends if you use oauth or not. If you have your own backend with auth then just store tokens in secure, http only cookies. If you use oauth then use implicit flow with pkce enabled.

[@sakesun]

When there is any Venn diagram, the video will certainly be popular.

[@theocrp]

You stated you didn't want to show the auth provider you use however it shows up as openauth in the dependencies in the video.

[@t3dotgg]

I didn't want to state it because I was waiting to do this video

[@theocrp]

@@t3dotgg Yeah that makes sense, your approach on authentication is great though. Keep up the good work man!

[@josh4play.youtube]

Hi quick question, what about Supabase Auth - I have used it in a recent project and it is really good actually. Its also really really cheap compared to Clerk. Does anybody have an opinion on that or an even better solution?

[@RandomZenji]

the best way is to implement your auth, lucia-auth new docs is a good start for basic auth but still there is a lot of missing info there to implement production level auth.

[@devanfarrell16]

I definitely use the webhooks feature for Clerk. I have several join tables with users though so it made sense for me.

[@RemotHuman]

16:05 makes me think we need some kind of standardized abstraction over infrastructure so that libraries can interface with infrastructure in a consistent way. that way a lot of repeated work (and the maybe some of the moat of SaaS es like clerk) would be eliminated. kind of like why you may like react server components - as they make your backend and frontend into one set of legos that a library can build with - well that should extend to your whole backend including your database(s) / state holders I don't know if the more enterprise world already does this with something I haven't heard of - maybe it is possible with Infastructure-as-code (like sst)?

[@TheBelafleck]

There is an argument for auth0 if you are in europe and care about co-location: They have european tennant

[@LtdJorge]

JWTs should literally be http-only cookies. At least for refresh tokens, so you can forcibly expire them and cannot be stolen.

[@romanochernetskii823]

so which one am i using for my todo app?

[@thirdbeat]

WELL.... jwt is more a resulting format of a cryptographic function than a storage medium. In OpenID both access and refresh tokens can be defined in jwt format. Being a seasoned dev, I'm pretty sure you know this and know that for most service-service connection you most likely "authorization" header with a bearer jwt token. Cookies/App storage are the storage medium, JWT is the token format

[@zwanz0r]

JWT and local storage/cookies are different things. You can store JWT in a session cookie. Using localStorage for JWT is a weakness

[@techytech26]

What about supertokens and self hosting with it?

[@alphalencho]

Better-Auth 👌👌

[@joeellul-turner1280]

51:00 you suggest storing the data in your db is a bad thing. I literally chose it for this reason

[@tarikulislamanik]

What about SuperTokens?

[@utherali6739]

idk why i still click on these videos

[@maciekdeveloper]

Basically just ads

[@meladthegreat]

Firebase auth? Supabase auth? Workos?

[@ColbyGilbert]

Roll your own

[@LucianTugui]

missing Stytch?

[@valera518]

Better Auth is the best solution

[@calebirwin6786]

the whole middleware performance issues are super easy to fix in sveltekit

[@giraudl]

Zitadel checks Everything

[@laviray5447]

I am confused, why clerk is better than better-auth when it comes to mobile apps? If I use better-auth with my express server and use the same API in the app for auth would I have a problem with better-auth?

[@tarwin]

Hmmm. I worry that you say "jwt in localstorage". It's not horribly bad, but not great. Really should be stored as a secure http only cookie. Otherwise it can be stolen by 3rd parties. Probably not a problem but ... Also, on the route stuff. I'd like to hear more on where authentication/authorization should go. A lot of the time I have global "need authentication except for specific /public/* routes" and then specific authorization with middleware. So interested in other ways?

[@Marviuz]

Now that we're talking about auth, I wanna ask about race conditions when refreshing tokens which happens when you have multiple private api calls spread around different components.

[@abhishekmehandiratta4241]

I solved it by implementing a request interceptor and having a mutex lock acquired before token refresh. This allows only one request to actually refresh the token.

[@Marviuz]

@@abhishekmehandiratta4241 I tried that and I wasn't successful which most likely a skill issue. Do you have a repo I can review?

[@user-wg5rs7bh5u]

What do you think about keycloak for auth in an organization?

[@codeaperture]

What do you use between StackAuth and BetterAuth?

[@fredericorinco9133]

sad you didn’t mention Kinde

[@schtormm]

why in the name of all that is holy is there an auth provider whose name ends in "OS"

[@kocokan]

New hairstylist?

[@jozsefsebestyen8228]

I want a video about Credentials Management API!

[@PercyMelody]

One of the reasons i left js land....some times you even have to pay for auth

[@goldydog1]

Authjs doesn't handle access token rotation, which is a huge downside

[@mikee.]

Whatever happened to POST /login username/password, compare hash and store cookie?

[@ShinSpiegel]

JS with access to cookies is a security issue.

[@phendan]

If it's client-side JS then yes, but I believe what he demonstrated was server-side

[@complexity5545]

Most people/programmers won't know he really means nodejs server backend (and not your device's browser (front-end)).

[@_tr11]

​@@phendanwhy?

[@phendan]

@@_tr11 You'll have to be a bit more specific. Why what?

[@_tr11]

@@phendan why is js with access to cookies a security issue? it's *your* js on *your* webpage after all

[@amosmachora]

Hey Theo. Love your vids as always man. Could you link me to the place where google gives a guide on how to use their sign in with google button, the color sizes etc etc?

[@VgcGamingLP]

Doesn’t even mention supertokens :(

[@SXsoft99]

There are so many guides on basic auth and how to handle multiple step auth on the internet yet people are too lazy to learn and want everything to be just handed to them One of the first things you learn as a PHP (yes start hating on me) is how to do a basic auth I guess people just like to outsource their work to third party companies for something basic.....because they marketed the tools too much

[@kidushh4426]

Better Auth 🔥🔥

[@m4saurabh]

Needed this

[@puremajik]

Which is the best for offline-first?

[@plaintext7288]

Just use text files on the server. One line = one entity

[@plaintext7288]

it's even possible to version control it in a git repo and have a file per entity type

[@wshewm]

This is exactly what I’m doing right now in production. Never had any problems. It’s hilarious how these JS devs add a new framework every week to solve a problem that’s already been solved by GitHub and text files

[@_tr11]

how much data are you gonna store in that file 😭 how do you handle locking too? just use SQLite at this point

[@Malix_Labs]

bro just banned himself from employment

[@amosmachora]

I used Next Auth a while back and it was war.

[@scienceandtheuniverse7105]

better auth all the way

[@tmerb]

How do you go from '.. not clerk, I will not let them influence this video' to 'I'm bias cause clerk is a sponsor' in under 30mins. 😭

[@schtormm]

What he probably meant is that he always will have a bit of bias towards Clerk because they sponsored him in the past

[@samarnagar9699]

Aaaahhh hair what happened there

[@megamind452]

Better auth ❤

[@Thomas-dg6iz]

Is that an ARC browser? 🤨😅

[@cyberwaves]

I might not fit here because I'm still using passport from past 6-7 years.😥

[@LostZenith_]

I've used NextAuth.. not in a successful way, but I've almost managed. HOWEVER, I used Clerk, and it was the easiest thing I've ever implemented. It was beautiful. I may just be lazy, but the lack of effort Clerk took, compared to NextAuth was amazing. I should understand how Auth works better at a coding level, but I've only implemented auth with C# scaffolding using Visual Studio, and it's already basically completed for the dev there. Maybe I'm just getting heavy skilldiff but Clerk was amazing and super easy... but I don't have $25/month to use it.. but I guess at that price point, you're paying for the convenient

[@Samuel_Fikre]

Bro use better auth

[@george2580]

Why make my life hard and not include timestamps, please bro pleeease!

[@praveenjuge]

I don't wanna learn backend, so I use clerk

[@buildwithharshit]

I found you in yt too 😅

[@soumalya]

Get over this crap and write your own service. Honestly if you plan properly its not that hard

[@RadTwin]

Supabase

[@Headassss]

Im trying to figure out why this is overlooked

[@devfren]

people probably think you gotta roll the whole supabase stack, you don’t, and the docs are great. Open source too

[@_tr11]

real

[@Jonesrful]

Auth yes

[@clementmmas]

I use Laravel. It’s a solved problem.

[@Malix_Labs]

Laravel itself is an added problem

[@twisterrjl]

Meet a senior dev in person (not Theo) and ask them about auth. Simple. Plot twist: auth is not hard, at all. A high-school kid could do it.

[@w1-w2-w3]

Only in JavaScript. 😂😂😂

[@_tr11]

javascript hater 😂😂😂 doesn't even understand how js works 😂

[@Kerrrrrrry]

:)

[@vaibhavrai4417]

lol first one

[@_tr11]

no. you were second

[@vaibhavrai4417]

@@_tr11 yes ur right

[@SamuelRaynor79]

Can we remove "modern" from our collective vocabularies? Thanks. 😂

[@alek282]

First

[@richreid45]

Fifth