search

haskell-servant / servant-auth

160 stars 73 forks source link

Improving the state of servant-auth #195

Open Kleidukos opened 3 years ago

Kleidukos commented 3 years ago

At the time of writing, the state of servant-auth has a margin of improvement when it comes to both design, security and supported authentication schemes. I would like to take the time with industrial users to setup a better workflow in how we use Servant to protect endpoint and authenticate requests.

This is a work on design, implementation and documentation.

cc @domenkozar @divarvel @fresheyeball

Fresheyeball commented 3 years ago

@Kleidukos how can I support this effort most efficiently?

Kleidukos commented 3 years ago

@Fresheyeball Sharing your experience and/or setups can be very helpful. The main pain points that you've had, and if there are designs from other languages/libraries that you think would be a better fit

domenkozar commented 3 years ago

I took over the maintenance after a lot of help from @alpmestan when I needed to figure out servant-auth. I share the same experience as others of wasting countless hours, but I did put a lot of those hours back so that it's a tiny bit better nowadays.

Here's a short overview of incremental changes with the most impact:

Commonly requested features:

Last but not least, the plan is to port servant-auth to servant and deprecate the old auth: https://github.com/haskell-servant/servant/issues/805

These days I'm in brutal prioritization mode of scaling my business, so I can't do much maintenance but I do want to do everything I can for someone else to step up!