[flagged]
Even "I'm sorry but" is the sort of flamebait we're trying to avoid here.
If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
Edit: you've unfortunately been doing this a lot lately:
https://news.ycombinator.com/item?id=40819104
https://news.ycombinator.com/item?id=40818298
https://news.ycombinator.com/item?id=40817238
https://news.ycombinator.com/item?id=40810372
We have to ban accounts that post like that, so if you'd please fix this, that would be good.
For example react-oidc-context on the client side and Passport.js on the server, or Casdoor.
Edit: dockerized services sound interesting, do you have an example?
Verifying you haven't broken any of these things is hard, and monitoring for breaches when you have a lot of legitimate users is very hard.
Supporting your customers when they have problems is hard.
Debugging issues with a thrird party in the loop is hard.
Just because you farmed out auth doesn't mean you get to stop monitoring for breaches, or doing all the other things you need to do to have an eye on security.
Farming out auth just ads a recurring cost per user and complexity that your going to ignore till its a bigger issue than dealing with this up front would have ever been.