How would you implement authentication if you'd build a new SaaS app in 2024?

@thestarkster Thanks Gurkaran. Can you give some examples of what you would build custom if you already use a service like Auth0?

@zignis So build everything custom huh? Just to save costs or any other considerations for that?

@jopie I've never been comfortable using third party services for authentication. If things are built in-house you have more control and less ways to leak info/mess up sensitive user data.

@zignis Interesting, that's contradictory that what I often read. Many say use an established, dedicated server for this, so that you're sure it's secure. I have also built simple auth in my product myself, but am not sure what I'd do if I had to choose again.

@jopie I'm not against third party authentication services, the only thing is that you have an extra point of failure. Your product will face downtime whenever the auth service is down. Migrating between auth services is time consuming. It's easy to set to auth using external services but if you can spend some time building a custom solution while keeping the best security practices in mind would prove to be better. You would have the complete control over the user data that you store, and how you authenticate your users. And it's cheaper in long run (hosting a redis server isnt too expensive) or you could use JWT if you don't want to keep the track of user sessions, that is the cheapest option.

@zignis Yeah makes sense. I'm now using custom JWT and it is certainly doable and not even much work to maintain. But there is the risk that a lot needs to be added for larger clients for example. In that sense it seems easier to scale with a service. Ofc also becomes expensive then, but not sure how it relates to implementing stuff like 2FA and SSO yourself. Can imagine the engineering hours start adding up then as well.

@andreiciulinaru So like a magic link type of login? Or is that an id you keep throughout the lifetime of the user? Normally you would use JWT for something like that I'd say, right?

@jopie It's an ID I will keep for the user's lifetime as you said. I don't have anything sensitive in the app requiring me to think of more advanced ways. Alternatively, I would implement a 'sign in with google / sign in with twitter ' oauth option if I needed more security. But I am new to this too so don't mark my words :D

@andreiciulinaru Cool, yeah if it's okay that anyone with that link can access the app, then it seems fine. Always great if you can keep things simple!