Has anyone built their own authentication system?

Re:Has anyone built their own authentication system? by gregopet on Saturday July 20, 2024 @01:10AM (#41014240)

For a simple website JWTs are almost definitely an overkill (you would get all the drawbacks for none of the benefits). A session based authentication with some libs from your ecosystem for the crypto parts and a nice intro on how to combine them together could be the perfect thing for you.

[ Parent | on HN ]

Re:Has anyone built their own authentication system? by rat9988 on Saturday July 20, 2024 @01:58AM (#41014416)

I have always found jwt easier to deal with than session based authentication.

[ Parent | on HN ]

Re:Has anyone built their own authentication system? by mhitza on Saturday July 20, 2024 @04:12AM (#41014936)

Nice thing of using sessions is that you mark cookies as HttpOnly and you avoid them ever being leakable by crosssite scripting. And you get them transparently in your JS -> backend calls.

Of course downside is that once you move to multiserver you have to think of setting up sticky loadbalancing or distributed sessions.

[ Parent | on HN ]