gfontenot
commented
1 year ago Fiddled with this today, a few thoughts:
- Yesod.Auth.Email feels.... like a lot for this. I especially dislike all of the default forms and routes that are created. I'm a little worried about having those routes kicking around for people to access directly too.
- Yesod.Auth.Passwordless might be nice? I'm not sure how much I trust it though, it doesn't seem to have a ton of users
- Maybe it's worth rolling my own thing using JWT? jose-jwt seems pretty robust and this would definitely give me the most amount of control over the result. Maybe more work though? I'm honestly not entirely sure if it would be.
I think I'll start by looking at what it'd take to roll my own and then if I'm completely out of my depth (likely) I'll drop back to using Yesod.Auth.Passwordless. And if that causes issues I'll come back to Yesod.Auth.Email and fumble my way through trying to shut enough of the functionality down that I feel comfortable.
I want a passwordless auth flow because I do not want to store passwords.
Flow:
loginR -> User enters email -> Email sent with magic link -> Magic link clicked -> User logged in (new user created if necessary)