Signup & Next Auth

Hey all! I'm new to sign up and Next Auth and had a question about handling both. I'm using T3 Stack for my app and have a signup form setup and working. I'm wondering when it comes to signin, I query the DB with the user input, if successful should I be using Next Auth Email Provider or Credentials Provider? There are a ton of guides out there for Next Auth but pretty much all of them cover OAuth and not handling email/password signup/login. I like the MFA provided by Next Auth Email Provider so it'd be nice to keep and and not have to build it from scratch
81 Replies
barry
barry15mo ago
Because it sucks at email or username auth
SiiR
SiiR15mo ago
What does? That doesn't answer my question I'm here to learn so I'm open to being taught. I've never dealt with account creating and auth so it's a brand new thing to me. If I should ditch Next Auth that's cool, but why and what else?
barry
barry15mo ago
next-auth sucks at anything not oauth
SiiR
SiiR15mo ago
Ok I'll look into alternatives. I liked the idea of Next Auth since it would handle sessions and JWT's for me as well as the MFA but if there are better solutions then I'm all for it. Thanks for the feedback
machina
machina15mo ago
I'm doing credentials with Next Auth right now it just checks the credentials against a database and returns a JWT to the browser if its a match. and you get to handle your own verification logic inside the authorize() function in auth/[...nextauth]/route.ts can you explain in detail what makes it suck at credential based auth? I might jump ship if its bad enough also what would you reccomend for implementing auth
barry
barry15mo ago
jwt's, the fact you need to use a jwt because it's credentials is dumb
barry
barry15mo ago
if you're doing credentials then https://lucia-auth.com/ or rolling auth yourself is what i would do
Lucia
Lucia
machina
machina15mo ago
whats wrong with jwts for credentials? what are the downsides to requests getting prefixed by a token unique to that user? and what would a better alternative be
barry
barry15mo ago
I kinda just follow OWASP's recommendations, to use sessions whenever you have stateful auth. The major downside of JWT's is you can't kill a session, or change a role of a person. Or, it won't be reflected until a new JWT is generated So if someone is promoted to admin, they won't see until a new JWT is made If a user is banned off of a service, they're not banned until the JWT runs out If a user wants to kill a session it can't be
machina
machina15mo ago
Hm. so if you ban a user, and they keep their old JWT, they can still act as if they weren't banned?
barry
barry15mo ago
Yup Since the JWT is either valid or not Based on encryption Not based on what the database says
machina
machina15mo ago
is there a way to quickly invalidate and replace their jwt so that doesn't happen
barry
barry15mo ago
That's the upside, you don't have to access the database to check By adding a check in the database, but now you've neglected the upside of JWT's And basically made sessions with JWT's Doesn't make sense Just use sessions lol
machina
machina15mo ago
So with sessions, do you do a db lookup everytime the user does a request? and verify it against the db?
barry
barry15mo ago
Yup
machina
machina15mo ago
damn LMAO
barry
barry15mo ago
That's not slow though It's pretty damn fast
machina
machina15mo ago
is there a go-to standard library for managing session auth? is lucia that library?
barry
barry15mo ago
Nope There's libraries for it for almost everything
Neto
Neto15mo ago
js is the wildwest of libraries if you can think of a problem that you dont want to solve, there is a library for you (probably) out there
barry
barry15mo ago
Express has express-session Fastify has fastify auth and fastify session Gorillamux has gorilla/sessions Fiber has their session middleware There's always going to be a library for doing it tbh It's been the standard way to do auth for decades
machina
machina15mo ago
so why do you like lucia
barry
barry15mo ago
Because it's in typescript land I also like doing it myself
machina
machina15mo ago
does next-auth really only support sessions for oauth? thats weird
Neto
Neto15mo ago
it does support password sessions but the experience of using it is awful next auth in general has a really weird experience of using it its fine until you find a very very very weird problem that is very hard to poohheh
barry
barry15mo ago
oauth is great so i dont mind but ive been playing around with passwords etc so its not viable for me
SiiR
SiiR15mo ago
Do you have a repo I could look at? @thatbarryguy That's quite informative, thanks again for the feedback. This is my first time diving into account creation and auth so I'm completely in the dark with goto's and howto's
machina
machina15mo ago
https://github.com/machina20/prisma-learning-/ right now it just has username/password login/registration. Once you register an account, it sends an email using mailgun, and then once you nav to the link it sends you, your account is now verified and you can log in.
GitHub
GitHub - machina20/prisma-learning-
Contribute to machina20/prisma-learning- development by creating an account on GitHub.
machina
machina15mo ago
it uses prisma
SiiR
SiiR15mo ago
Thanks, I just want to checkout how you handle Next Auth with this but from what I read above it seems to make sense to use Lucia
machina
machina15mo ago
seems that way haha @thatbarryguy @nyxawaits do you guys have a reccommended way to send emails? with a nextjs app
Neto
Neto15mo ago
resend
Neto
Neto15mo ago
Resend
Build, test, and send transactional emails at scale.
SiiR
SiiR15mo ago
Thanks guys
machina
machina15mo ago
how does this stack up to node mailer, mailchimp etc looks cool
Neto
Neto15mo ago
resend you can use "react to write mails" node mailer, mailchimp and others only send the email you write the content and such
SiiR
SiiR15mo ago
I remember looking at this in my last job. Anyone that's written email templates before knows the pain of not using React
Neto
Neto15mo ago
writing emails is painful overall so a provider that you can easily use something like react is very very nice not even react itself, writing emails is just annoying each provider render differently, so its a shit show
SiiR
SiiR15mo ago
It really is, and there isn't an industry standard for sizing or light mode vs dark mode targeting across the different platforms
machina
machina15mo ago
damn this looks pretty cool. What would you say are the email services that dissenters would say are better than resend
Neto
Neto15mo ago
most of them do the same
send emails
what matter is what you want dx-wise resend feels the best
machina
machina15mo ago
what do you recommend as far as auth libaries go? lucia as well?
Neto
Neto15mo ago
next auth is okay im a fan of lucia most paid auth providrs are fine
machina
machina15mo ago
are clerk and supabase paid
Neto
Neto15mo ago
if they have a free tier is even ebtter
machina
machina15mo ago
one thing though is breaking changes
Neto
Neto15mo ago
clerk with free tier same with supabase
machina
machina15mo ago
would using a service like supabase or clerk be better just to avoid the breaking changes
Neto
Neto15mo ago
most major auth providers have a free tier offer
machina
machina15mo ago
what would you say is the most popular auth solution today
barry
barry15mo ago
Sendgrid I guess There isn’t really one
Neto
Neto15mo ago
most of them have tradeoffs
barry
barry15mo ago
Comes down to what the backend is made with
machina
machina15mo ago
what if its a nextjs project with a postgress backend running on a docker container
barry
barry15mo ago
Well hopefully that’s at least 2 containers
machina
machina15mo ago
you mean like a container for the application too?
barry
barry15mo ago
And a third for nginx or caddy or something 1 for next 1 for postgres 1 for nginx / caddy Could have more like a tls service etc
machina
machina15mo ago
is it better to deploy on vercel to use the regional edge functions for cheaper? i heard thats a lot cheaper than lambda and faster
barry
barry15mo ago
🤷
machina
machina15mo ago
have you ever used vercel
barry
barry15mo ago
Yes
machina
machina15mo ago
i'm using it to host my portfolio so i'm assuming it does the nginx load balancing stuff automatically. I'm scared of hidden scaling costs though
Neto
Neto15mo ago
vercel free tier is very generous
barry
barry15mo ago
For some things But image optimization and other features. Not so much
machina
machina15mo ago
how do you guys feel about clerk.dev?
barry
barry15mo ago
meh
Neto
Neto15mo ago
^
machina
machina15mo ago
People give good reviews for that on Reddit. Have you guys used clerk? Also what do you guys think is the best tech stack for a solo developer doing SaaS applications I’m always afraid of spending lots of time diving into something that may not be the widely recommended tool for a certain job
Neto
Neto15mo ago
unless you are experienced dont roll your own auth using clerk/auth0/whatever is fine as long its a recommended service you can try clerk and see what happens
barry
barry15mo ago
I personally don't like that take, it's not as complicated as it's made out to be
Neto
Neto15mo ago
if you are using oauth stuff, sure
barry
barry15mo ago
Email/Username & Passwords too OAuth is more complicated
Neto
Neto15mo ago
yes next auth exists for that
barry
barry15mo ago
Meh, it's more complicated but not necessary for an auth lib
machina
machina15mo ago
when you guys say "roll your own auth" do you mean something like lucia? or even more low level than that??
barry
barry15mo ago
literally just writing all the shit yourself
machina
machina15mo ago
I write my auth directly in assembly i prefer the control it gives me do you do this with REST api's? hm what is the traditional route to do the things that Resend does? What would need to be done under the hood?
Neto
Neto15mo ago
something like aws ses, sendgrid, or another basic mail sender then something to create the email content
machina
machina15mo ago
Is something like Resend worth it at the higher tiers? or would it be better to implement it yourself in the long run
Neto
Neto15mo ago
you can use https://github.com/resendlabs/react-email and use your own email provider
GitHub
GitHub - resendlabs/react-email: 💌 Build and send emails using Reac...
💌 Build and send emails using React. Contribute to resendlabs/react-email development by creating an account on GitHub.
herbertsmith
herbertsmith15mo ago
This was a fantastic read, thank you for your insights
Want results from more Discord servers?
Add your server