Authentication

[Security2431]

Good to know:

TODO:

• [ ] Best practice
• [ ] #57
• [ ] Session Cookies
• [ ] #56
• [ ] Open ID
• [ ] #54
• [ ] #55
• [ ] SSO

[Security2431]

Services	Pros	Cons	Conclusion
next-auth	✅ Credentials auth ✅ Auth session ✅ oAuth 2.0 ✅ Magic Links ✅ Free solution	❌ Expo	It's a powerful library, supports prisma DB and have different case solutions. However, expo is not supported. We can use different solution for expo example
oAuth0	✅ Credentials auth ✅ Auth session ✅ oAuth 2.0 ✅ Magic Links ✅ Expo	❌ 7K users/m free	It's a great solution, unless the price and the controllability
Firebase	✅ Credentials sign in ✅ oAuth 2.0 ✅ Magic Links ✅ Expo	❌ Prisma	Great, unless we've already have MongoDB database
JWT	✅ Credentials sign in	❌ oAuth 2.0 ❌ Magic Links ❌ Expo	It's just web email/password authentication. May be worked in a pair with other services
Supertokens	✅ Credentials auth ✅ oAuth ✅ Magic Links ✅ Free solution ❓ Auth session	❌ oAuth 2.0	- Is it really free service?🤔 https://supertokens.com/pricing
Passport(NodeJS)	✅ Credentials auth ✅ Auth session ✅ oAuth 2.0 ✅ Magic Links ✅ Free solution	❌ Expo	Good technology for oAuth, unless its a bit complicated🤔
aws-amplify	✅ Credentials auth ✅ Auth session ✅ oAuth 2.0 ✅ Magic Links	❌ Weird pricing policy	Haven't look yet, but its aws solution. They always has pitfalls
apollokit	✅ Credentials auth ✅ Auth session ✅ oAuth 2.0 ✅ Expo ✅ Free solution	❌ Magic Links	It's a starter pack. We don't need to use all features from one. However, we can borrow some of approach repo

[Security2431]

Some links: Good to know:

• [ ] One more example with auth
• [ ] 👉PassportJS non official docs
• [ ] 👀 tRPC auth https://trpc.io/docs/server/authorization
• [ ] 🤯 Really different demo projects with nestjs and auth
• [ ] 👀 nestjs-with-auth demo
• [ ] [NEW] prisma schema for auth
• [ ] [NEW] Prisma email authentication
• [ ] [NEW] User session passportJS
• [ ] [NEW] NestJS auth demo
• [ ] [NEW] tRPC router with NestJS controller repository. The original article frontend auth
• [ ] [NEW] NestJS auth with controller https://github.com/islavi/authentication-authorization-server/blob/master/src/auth/auth.controller.ts
• [ ] [NEW] prisma auth https://www.prisma.io/blog/backend-prisma-typescript-orm-with-postgresql-auth-mngp1ps7kip4
• [ ] ❗❗❗ [NEW] How to secure routes in nextjs https://www.freecodecamp.org/news/secure-routes-in-next-js/
• [ ] Auth Guard in NestJS https://medium.com/@bhanushaliyash2000/implementing-an-auth-guard-with-jwt-tokens-in-nest-js-92176a9c3457
• [ ] NestJS auth like a pro https://medium.com/@jose-luis-navarro/logging-on-nestjs-like-a-pro-with-correlation-ids-log-aggregation-winston-morgan-and-more-d03e3bb56772
• [ ] oAuth with Session https://stackoverflow.com/questions/71021405/nestjs-using-oauth-along-with-session
• [ ] JWT auth token https://www.elvisduru.com/blog/nestjs-jwt-authentication-refresh-token
• [ ] auth 2.0 https://habr.com/ru/companies/dododev/articles/520046/
• [ ] OpenID vs oAuth https://frontegg.com/guides/oidc-vs-oauth2
• [ ] JWT Authentication with Access Tokens & Refresh Tokens In Node JS https://dev.to/cyberwolves/jwt-authentication-with-access-tokens-refresh-tokens-in-node-js-5aa9
• [ ] JWT auth with Test coverage https://medium.com/aeturnuminc/node-express-mongodb-ts-jwt-authentication-with-100-test-coverage-858636600f04

[Security2431]

Approaches:

	Session cookie	JWT	Combination of session cookies and JWTs
Pros	Security	Performance	Balance between performance and security
	Can control all sessions and delete from database on logout	It doesn't involve DB call, so this approach is much faster	Session cookie static value for user auth and jwt token refresh, jwt for server requests
Cons	Enval DB on each server request	Can't invoke the token before it expires (that's why set the token from 5 to 30 minutes)	Complexity and self-maintained
		All the data in the JWT token will exist (user role, user id, blocked user, etc.) until the token expires
		Length of tokens, sending a large volume of data on every request
Solutions	Replace normal db with redis	Store a list of "revoked tokens" in a database for sign out	I don't know any solutions for it

[Security2431]

SSO

[Security2431]

SSO: