I’ve seen a lot of developers asking questions like “Should I build my own auth for my app?”. While the answer cannot be a simple "Yes" or "No", I’d like to write an article to breakdown the implementation and demonstrate the pros and cons to help you decide.
I’ve seen a lot of developers asking questions like “Should I build my own auth for my app?”. While the answer cannot be a simple "Yes" or "No", I’d like to write an article to breakdown the implementation and demonstrate the pros and cons to help you decide.
TL;DR It's necessary to find an existing solution that fits your needs, unless you really want full control or you're still learning software development.
As a developer, I have built many applications during my career. Regardless of the programming language, there is a common foundation I always need to construct: user auth.
It was a negligible part since everything was straightforward going back to 20 years ago:
That’s it. Then I could focus on “the real business”. Didn't hear about MD5? You missed out on the "good times" of software development. Nowadays, developers face more challenges when building sign-in/up.
It sounds alarmist, but let me go through with an example.
Let’s say you are trying to build an online bookstore with an API service and a web frontend app.
First, the scope of “auth” should be defined. Auth can be explained as authentication and authorization, and they have totally different definitions and use cases:
I wrote an article CIAM 101: Authentication, Identity, SSO to discuss these concepts in detail.
Let’s start with “authentication”, which is user sign-in in our example. Besides the username-and-password method, here are some trending methods people are adopting for a better user conversion and security:
The choice of method depends on the business decision, while we can take a look on the tech effort:
[email protected], you can link this email address to the user foo in the bookstore. This process helps you to build a unified identity system and allows the user to modify or unlink their social identity in the future.After you decide authentication methods, a graceful and smooth sign-in experience for your end-users is the next target. The conversion here is fundamental but crucial to the business since it's a natural way to leave the persisted customer data.
When I was working for Airbnb, there was a whole team dedicated to optimize the sign-in experience for multiple platforms. They conducted numerous A/B tests to determine which combination had the highest conversion rate.
It’s not practical to do so when a business is getting started. But we still need to try our best to make every piece right. Which platforms would you like to run the bookstore? You may start with mobile, web, or both. The exact design will depend on the authentication methods you choose:
More things to consider to make it better:
If you opt for native development, the workload will almost double for one additional platform.
Security can be a hidden iceberg. It’ll be great if you are familiar with OpenID Connect or OAuth 2.0, since they are widely used and battle-tested. OpenID Connect is relatively new but is designed for “user authentication”, which is a great fit for an online bookstore.
Without delving into the details of the standards, there are still some things to consider:
Finally, you can land a good sign-in experience and deliver it to your customers.
As a bookstore, you need to separate resources for customers and sellers. For example, customers can browse all books, while sellers can manage their on-sale books. It's OK to start with simple if-else checks; however, as the business grows, you may need to leverage a more flexible model such as Role-based Access Control (RBAC) or Attribute-based Access Control (ABAC).
I also wrote an article CIAM 102: Authorization & Role-based Access Control to demonstrate basic authorization concepts and the RBAC model.
You can see auth is not an “all or nothing” problem, since it involves multiple technical components and you or your team may have different tech expertise in these areas. It's important to break it down into smaller parts to gain a better understanding of the status quo.
To make the decision, I'll ask myself the following questions:
With the questions in mind, I discovered two facts:
So I decided to start a dedicated project (Logto) for auth, and embrace the open-source community from day one.
Hope this article helps.