express-jwt VS next-auth

Auth0’s previous advice for protecting Express APIs was with a combination of three SDKs: express-jwt, express-jwt-authz, and jwks-rsa. And whilst these work well and are popular SDKs, we felt the developer experience could be improved.

Express-jwt: a great package that seamlessly integrates into Node.js Express apps. I highly recommend it if you’re building with Node.js and Express.

This article will serve as a guide on how to create a simple finance management app using Arcjet, Next.js, Auth.js, Prisma, SQLite, and Tailwind CSS. Building a personal finance management app with modern web development skills, practical functionality, and robust security helps drive home the point of how effective it can be to incorporate these features. Our application will be proof of concept, so there will be no live working payment gateway.

To secure page routes and endpoints in your application, consider using NextAuth.js (repository). You can either create your own custom login system and database or integrate with popular auth providers like Auth0 or Google.

I use authjs (aka next-auth) and recently documented that Google login requests additional access every time the user logs in[1].

I created an issue with a repro, although the maintainers moved it to discussions. It seems that the problem is with Google, but in that case I don't understand why the next-auth example works fine[2].

There are other users affected. If anyone knows how to solve this problem, I would appreciate it if you could say so.

https://github.com/nextauthjs/next-auth/discussions/11160

You can tweak this file as per your requirement. I am going to use Google Oauth to signin you can use others also. you can see from auth.js docs.

from time to time config is just not willing to sit there in a list. it needs to be computed.

just an example from a few days ago. someone needs to pull data from some remote service (maybe Vault), or generation of keys/entropy/etc. [0][1]

of course this just means folks should wrap the whole thing in a program. but that's getting inefficient fast if every layer only accepts "env vars" or a plain JSON file.

[0] https://github.com/nextauthjs/next-auth/pull/9638#issuecomme...

[1] https://github.com/nextauthjs/next-auth/pull/9638#issuecomme...

Auth.js

NextAuth.js for authentication

For federated logout you my want to check this discussion on github: https://github.com/nextauthjs/next-auth/discussions/3938

Auth.js (successor of NextAuth) is a flexible authentication library that supports many authentication providers and strategies. Although you can use many external services for auth, simply storing everything inside your database is often the easiest way to get started.

NextAuth.js is not perfect. One of the shortcomings is that it currently does not implement federated logout. This means that even if a user signs out of the Next.js app, he does NOT get signed out of the Cognito user pool client. As a consequence, the user is not really being logged out (i.e he is able to login again without providing the credentials). You can read more about this problem in this Github thread.