gotrue
Ory Kratos
gotrue | Ory Kratos | |
---|---|---|
22 | 41 | |
3,722 | 10,599 | |
1.0% | 1.2% | |
3.6 | 9.6 | |
5 months ago | 5 days ago | |
Go | Go | |
MIT License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
gotrue
-
Supabase Auth: Identity Linking, Hooks, and HaveIBeenPwned integration
If you’ve been following us from the start, you will know that Supabase Auth started by forking Netlify’s GoTrue server. A lot has changed since then and we’ve diverged from the upstream repository. At this stage it makes sense to rename the project to something else (cues drumroll) — Auth.
-
FATA[0000] Error 1130: Host '172.17.0.1' is not allowed to connect to this MySQL server
I am testing gotrue netlift module https://github.com/netlify/gotrue
- Netlify Gotrue – SWT based API for managing users and issuing SWT tokens
-
gotrxx VS gotrue - a user suggested alternative
2 projects | 11 Mar 2023
I guess since it's a deviation of it
- GoTrue is a small open-source API written in Golang
-
Ask HN: Ok to only allow Google/Apple/FB login for mobile app?
To answer point 1: Maybe to start out, but in the long run, having only social logins may cause your app to lose a segment of the market (I don't know how much). If you're fine with that, then by all means only support social logins.
However, I strongly suggest having it (or some way for someone not to use a social provider) if you want to have as many users a possible.
Personally, I don't have a google account, I'm wary to use my Apple account for non-Apple sites, and I don't have facebook, instagram, new gen z hotness app, etc... And I can confidently say I am not alone in choosing to use apps which don't require a social login.
At the end of the day though, password auth isn't a non-trivial problem. It is a solved problem of which there are numerous articles/papers and many libraries for most languages/frameworks. For example, the Phoenix framework for Elixir has a built in command which scaffolds auth, and it works really well (I have used it in a personal project): https://hexdocs.pm/phoenix/mix_phx_gen_auth.html. For JS, you can use something like passport: https://www.passportjs.org/packages/passport-local/. If you want a separate service entirely (even though it would be more complex to have a separate service to start out), there is GoTrue: https://github.com/netlify/gotrue. These are just a few suggestions of tech I have come across. There is so much more out there, I encourage you to research options to see what may be a best fit.
If you're worried about password auth, maybe give one time passwords a try. They don't require any password reset flow, and are generally secure when implemented correctly. As an example, I don't have a password for my craigslist account. Every time I want to login, I can choose to get a magic link/otp which gets exchanged for a session. In practice (and this is my personal opinion), I prefer magic links. They are one time, hard to guess (again dependent on implementation), can be time limited, and most likely won't be intercepted in transit (though it could be in a rare circumstance).
To answer point 2: yes.
If your app is to order things (I use things in a general term) it sounds like eCommerce. And if you're in eCommerce, you better have a way for a user to track what they have ordered and how much they have paid for it at a minimum. Otherwise, your site may come across as a scam, even though it uses Stripe. Sketchy sites can use Stripe to get your money (albeit, it'll be a one time payment).
In conclusion, auth for your application seems crucial. Email/password auth is still relevant for applications. While not necessary for an MVP, there is a segment of the market you will lose if you don't have an email/password option, or even an email/OTP/magic link option (I don't know how much, really going off an educated guess).
Best of wishes in building your app! I genuinely hope it is successful and safe for people to leverage :)
-
I got tired of fussing with auth, so I built a thing for building OAuth login in under 60 seconds.
Use a self-hostable auth microservice like gotrue or authelia, ORY's suite of products, etc.
- what should I do about authentication in golang?
-
actix-session 0.6.0 is out - an almost complete rewrite!
Any examples for implementation like https://github.com/netlify/gotrue for Actix-web?
Ory Kratos
- Show HN: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
-
Show HN: Obligator – An OpenID Connect server for self-hosters
I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it?
https://github.com/ory/kratos
-
Show HN: Blueprint for a distributed multi-region IAM with Go and CockroachDB
I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited (https://github.com/ory/kratos/graphs/code-frequency) so I might have had a bad first impression.
A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I dont know if the owner are going to merge it.
An example that comes to mind is the OAuth email auto-verification or the search of users that is still super basic (we only recently got the filter of identifiers).
- Ory Kratos v1.0 with passkeys, MFA and multi-region
- Show HN: Open-source IAM Ory Kratos v1.0 with Passkeys, MFA and multi-region
-
What auth do you use? Why?
IMO it's almost always good to offer some OIDC social login, just depends what provider your users use.
- https://github.com/ory/kratos
-
Show HN: Open-source Auth0 alternative Ory Kratos v0.13 released – nearing v1.0
Check out the milestone on github: https://github.com/ory/kratos/milestone/15
not sure if that is everything.
-
State of OpenID Connect Providers
An open source solution pre-built from professionals like Ory Kratos or Keycloak saves you a lot of time and pain.
https://github.com/ory/kratos
- Create a Identity with ory console, CORS issue
What are some alternatives?
supabase - The open source Firebase alternative.
Keycloak - Open Source Identity and Access Management For Modern Applications and Services
postgrest - REST API for any Postgres database
SuperTokens Community - Open source alternative to Auth0 / Firebase Auth / AWS Cognito
authelia - The Single Sign-On Multi-Factor portal for web apps
zitadel - ZITADEL - The best of Auth0 and Keycloak combined. Built for the serverless era.
hasura_gotrue - This is a slightly extended version of Netlify's GoTrue. It includes a `docker-compose.yaml` file to deploy it together with Hasura. This set up uses two databases, PostgreSQL for Hasura and MariaDB for GoTrue. Have fun!
Ory Hydra - OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.
nextjs-supabase-auth - Sample project for setting up Supabase Auth in Next.js
Ory Keto - Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.
supabase-auth-react
OPA (Open Policy Agent) - Open Policy Agent (OPA) is an open source, general-purpose policy engine.