Hey fellow developers! I'm curious to hear about the most frustrating aspects you face when testing login and authentication during the development phase. I'm not talking about production; I mean the nitty-gritty of prototyping. What annoys you? It could be anything from setting up identity providers like Keycloak, Auth0, or Firebase, to constantly creating users, clients, and roles. Maybe it's dealing with redirect callbacks, expired tokens, or even training new developers on authentication. Or perhaps you just dread the whole process? Let's vent a little and share our experiences so we can all improve our approaches!
5 Answers
One major pain point for me is the Microsoft authentication flow. It would be awesome if there was a way for automated tests to bypass all those prompts about staying logged in and the Microsoft authenticator app, which just complicates things for automation! Also, setting up consistent test data can be quite a hassle.
About the transport issue you mentioned, that’s what the Backend for Frontend (BFF) pattern is for! There’s some insightful content about this trend, including a talk by an OAuth security researcher that dives into these concerns.
A quirky issue I’ve noticed is the push for httpOnly session cookies to reduce token theft risks. While it's a good trend, many of the major auth vendors still rely on JWTs as their main mechanism. This disconnect is puzzling because their tools and docs often don’t align with the latest best practices. For better security, I suggest exchanging JWTs for httpOnly session cookies after the initial auth, but it doesn’t eliminate the risk completely. Plus, it seems like nobody is talking about these techniques in their documentation.
Honestly, I think it’s all relatively standardized. If we follow the guidelines, there shouldn’t be much pain.
I find the documentation to be a real struggle. It feels like everyone uses their own terms or obfuscates payload descriptions, which makes understanding a standard spec super difficult.
Related Questions
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads