6 ms·
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could ha
by solatic 21d ago
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
- goosejuice 21d agoOry let's you do this I believe.
- vinckr 21d agoYup for the Ory managed service (Ory Network) you can export all data through the admin API including hashed passwords. Of course when self-hosting Ory you have full control over the database as well. Disclosure: working for Ory.
- leetrout 21d agoCounter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field? I think they allow export because they drew some interesting lines around their own mutability concerns. I also would never use cognito again. https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-updating.html https://docs.aws.amazon.com/cognito/latest/developerguide/co...
- voxic11 21d agoAuth0 and Firebase both let you export user password hashes (though I believe you need to open a support ticket in order to do it in Auth0's case at least). I think Cognito is actually one of the few with absolutely no path to achieving this.
- tatersolid 21d agoEntra External ID does not allow export of password hashes. It actually doesn’t allow a whole shitload of stuff that should be there by now. For example, it supports passkeys, but has no UI for adding or managing passkeys. You have to build that yourself. In a separate app, on a separate domain.
- sandeepkd 21d agoPersonally I feel the password migration feature should never be supported. Its ripe for abuse once you open up a pathway to it. SCIM as a protocol was meant to solve this problem, if everyone could just implement it.
- deleted 21d ago[deleted]
- cco 21d agoPretty much all of them do. Auth0 will be annoying about it but even they will do it I'm struggling to think of one that's refused in my experience.
- MrAlex94 21d ago> How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to? Clerk is surely one of the biggest and allows you to do this.