Auth0 in 100 Seconds // And beyond with a Next.js Authentication Tutorial 

There are no replies 😶

I have a stupid question, in case Auth0 servers are down for whatever reason, does that mean users for my app won't be able to login?

@@tenslider6722 very astute observation. Better self-host...

Yo

❓wait a sec, is this so big tech can know who is logging in and when to all your apps ❓ aint nothing free....

This. If you're building a personal project and don't anticipate getting a lot of users Auth0 makes sense, if you're anticipating a lot more user sign ups I would suggest something like AWS Cognito or just building your own. Switching to another auth provider later is damn near impossible so choose wisely.

@@mooshy5944 switching auth providers is far from "damn near impossible". It is probably one of the easier migrations to do.

You can export from fire base and auth0 without a problem.

@@ZephrymWOW Okay so how do you export existing Auth0 users into lets say AWS Cognito? Passwords and all?

Cognito defintely supports import from csv

Its free below 7k users

@@Exendes now, it's 1k

0.02 / month per user... It's not that bad.

@@edgarwideman737 lmaoo.. it is when you’re broke

You’re not broke when you have thousands of users. Honestly I was quite surprised how good their pricing is.

Cognito is awful + it's not part of Amplify, it can be used with Amplify

Yeah, stay married to those services.

Supabase auth is decent too

@@chiefdan07 Plus it's opensource. I've used it and I really liked the initiative and from some time, I've been a part of open source software and I'm in awe for such people who provide leading class software open-source.

I feel the same about using Facebook. However, I deliberately use Facebook instead of Google since if I ever lose my account for some reason, I don't also lose my entire email account. Most of the time, the sites keep your email stored and you can recover the account via email, which is only a problem if your email is also terminated (as it would be if your Google account was lost). And of course, I use my own domain for email so I can route mail to whichever provider I want.

@@ChrysusTV jeez how about not using a single service to manage all your data but maybe use password manager / hardware tokens / self hosted solutions instead. I see that SaS has its place, but I think authentication isn’t one of them. It should replace things that are you are not capable of hosting it yourself. Authentication is a solved problem and most frameworks make it very easy. I don’t know how trusting another company with all your user data, making yourself dependent and having to use an API is any better than using easy framework look ups from a database.

@@michaelb2047 My KeePass has 372 entries but thanks for your paragraph of concern. I'll use what I want to use, yeah?

@@ChrysusTV I would recommend against this. I got my facebook hacked and took months to regain control. They have zero support or care to get you your access back. It fucked up my ability to access all sorts of apps like Spotify. I no longer trust any of these universal login things.

@@michaelb2047 The issue is, more and more websites don't offer their own login system anymore, they only offer logins via 3rd party OAuth of Google, Facebook, Twitter etc.

Yeah and you'll have to pay a lot

F

@@user-if1de8pt2j he meant policies. you know, that's google and google has some good reputation on suddenly shutting down services.

@@arifdevcoding Or if they decide not to support the types of apps I decide to make, restrict collecting certain types of data, etc…

@@quasa0 I mean, depending on your situation it might make sense. But, frankly, for really critical aspects of my apps, I like having control over them. Only for non-critical things or things that are too expensive to implement are what I like to rely on third parties for. For example, hosting services. It’s way too expensive to run my own servers and data centers. So, I’ll rely on AWS or GCP. Email is another example. It would just take too much work to build my own Email service. But, storing users and and authenticating them are kind of really critical. So, I prefer to implement that myself. Plus, it’s not too expensive when you look at the bigger picture.

Yeah I've never really understood the appeal of auth-as-a-service, when rolling your own is pretty easy

@@michaelhays i mean implementing oauth for so many providers is time consuming and too much code writing. People just look for the easy way out. And then we get this. Just one sdk, no need of your own api, easy to use.

Agree. It certainly has a place in larger organizations, especially when it comes to compliance needs.

@@ratulsaha9487 implementing JWT OAuth is like 10-100 lines of code lmao. Especially if you just use a library to handle it

@@ZephrymWOW thats email password login. I clearly stated that the lengthy part is the 3rd party providers like google, github, etc

you can add metadata to the accounts. using the authO managment API

Yeah there's a hook for that. You can embed the form yourself using their APIs but it's much more work recreating all of the two factor flows and stuff compared to just using their excellent premade ones.

The redirect is required, you can only have a custom domain. If there is another solution, tell me. ;)

@@Blast-Forward Auth0 Lock...

did u found it ?

tell us bro

That's not necessarily true. Many of the authentication systems (Auth0, Firebase, etc.) allow roles, which are what you'd use throughout your app to control access after the login stage. Obviously, if you're not using roles, then sure you have to build your own access control. Otherwise, the roles are in the JWT, so then your concern would be whether JWT is secure or not, not if these authentication systems are useful. And roles can be used inherently in other parts of a backend depending on the provider -- for example, Firestore can use your authentication roles to restrict access to documents.