Ask HN: Alternatives to Passport Auth | Hacker News Reader

Ask HN: Alternatives to Passport Auth

9 pointsprmph9 comments

Is there another open source alternative to passport for auth in an express node API?

I am concerned that Passport plugins are not actually vetted for security

OP: For such questions and discussions, I recommend getting on IRC [0]. The Libera server [1]

IRC is a collection of chatrooms on all kinds of technical topics: programming languages, frameworks, cloud providers, topics

often hundreds of people are in each chat room. You can get live Q&A sessions with veteran and highly respected programmers.

I've chatted with an engineering director of AirBNB on a channel there, and also a security expert who was tracked by the FBI for a bit, for example-- interesting, intelligent people.

Examples of chatrooms ("channels") I am in: #nodejs #python #machinelearning #economics [3]

You'll need to learn how to register and login to IRC -- it's pretty easy, just involves a command. For Mac OS I recommend the LimeChat client.

[0] https://www.online-tech-tips.com/software-reviews/the-11-bes...

[1] https://libera.chat/

[3] https://libera.chat/guides/findingchannels

You could go with a non-framework style of authentication.

For example Barricade https://github.com/purton-tech/barricade is a small docker container that handles auth.

In terms of security, even if you integrate with a secure authentication system, your integration may be insecure.

So a PenTest is recommended anyway.

Jsonwebtokens (jwt)

And here it goes the eternal battle on whether JWT are a good solution for authentication or not.

jwt is delegating it to someone else right? who might be you (a second service) but someone needs to check a password somewhere

What are you trying to do? Are you storing username and password in your site, or connecting to a social or OIDC provider?

What kind of auth are you doing in a node API? (Vs in an express app that generates UX.)

OK so I'm actually building a low-code generator for express apps + APIs.

The app web UI apps have the usual cookie-based auth through sign-up and sign-in forms, but everything the app does is via the API.

So, for the generated APIs, I want to support the following auth strategies:

1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API

I assume these strategies are sound in general (if not, I'd like to know what the issues are).

But, the thing is, I don't want to use any 3rd-party auth services. I'd prefer to use middleware, or a library. I could write my own middleware, but I fear creating something that has some security weaknesses.

So what are my options? Passport would seem like a good option, but I am worried that many passport plugins are not vetted, or are they?. It seems anybody can just write and publish a passport plugin.

When doing OIDC, this one seemed like the best option: https://github.com/auth0/express-openid-connect

Passport's auth integrations often seem unmaintained, and I don't really like that passport sends the response for you on failure (which means it's not easy to modify, say, to make the response body JSON instead of text)

I'm sure Passport is "reasonably" vetted in that it's still the most popular swiss army auth tool in the node.js ecosystem. But I suspect it's not best-in-class for any one type of auth, and auth is really the type of thing you want to be using best-in-class for.

By the way, I'm curious what your process is for code generation.. I'm considering a code-gen solution to a problem right now.

Yeah, I don't know any other options for vanilla JS that support what you want. There are embeddable/self-hostable auth servers (FusionAuth--full disclosure, I work for them, Keycloak, Ory), but it sounds like you don't want to head down that path.

> 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API

> (if not, I'd like to know what the issues are).

For #2, if you are setting up OIDC, you typically don't get to control MFA. You're delegating the authentication event to the upstream identity source, so they control if they ask for additional factors of authentication.

For #3, would recommend the client credentials grant for your API clients, which is essentially an API key, but generates a time bound token and is therefore a bit more secure.

I don't know whether passport plugins are vetted. I suppose you could ask on the github repo: https://github.com/jaredhanson/passport

I didn't see a great way to buy/find support, but maybe there's a slack/discord out there?

Reply on news.ycombinator.com