6 ms·
I hand-rolled my own authentication on this site. But I had a good reason! Remember all the talk above about making things super fast by collocating the node se
by jcoder 5y ago
I hand-rolled my own authentication on this site. But I had a good reason! Remember all the talk above about making things super fast by collocating the node servers and databases close to users? Well, I'd kinda undo all that work if I used an authentication service.
This is a great example of how fundamental architecture decisions limit your subsequent decisions, and it’s your job as a designer to make sure that the final result makes sense and reflects good tradeoffs, not just the state as you go. Hand-rolling auth (a real risk) so you can use this unnecessary distributed deployment scheme (no real value) is a bad decision.
- andrewingram 5y agoThe auth thing was the main thing I questioned (aside from over-engineering, but my own site is guilty of that too). I thought part of the benefits of auth services like auth0 is that due to them having to provided some kind of trusted token containing an identity payload (eg a JWT), you can get away without having the query the auth service per-request (assuming you can tolerate stale tokens in the event of a permission change). So the performance issue being used to justify hand-rolled auth, seems to be the result of a misunderstanding.
- turtlebits 5y agoOr you could just stand up Keycloak along with your backend services