jose VS next-auth

JWT - jose

For demo purpose, we'll use some popular libs e.g. jose.

This module provides a lot of useful functions and utilities, but we will focus only on a couple of them. You can read more about the module itself if you feel like it.

Honestly, not exactly sure what the correct order is. The standard for encrypted jwt is called JWE. Most programming languages will have some kind of library that will handle the small details like order of operations. Example: jose for js.

I used standard Web APIs such as fetch() and WebCrypto. The most common thing I had to do was JWT token generation/validation. I worked with the jose library (the only dependency in the project) because it is cross-platform and also works with the WebCrypto API.

Biggest sharp edge I've encountered is the very much WIP WebCrypto API support. In practical terms, this means things like signing/verifying JWTs is not very well supported: https://github.com/panva/jose/discussions/243

That said, the situation is improving rapidly, and I've been personally willing to bet that the support will be solid by the time I finish prototyping and need to start adding auth to my latest project.

NextAuth.js is not perfect. One of the shortcomings is that it currently does not implement federated logout. This means that even if a user signs out of the Next.js app, he does NOT get signed out of the Cognito user pool client. As a consequence, the user is not really being logged out (i.e he is able to login again without providing the credentials). You can read more about this problem in this Github thread.

NextAuth for adding auth

Let's learn a bit about Descope and how to use it with Auth.js (next-auth) to protect our Next.js app with role-based access control (RBAC).

https://github.com/nextauthjs/next-auth/issues/5647#issuecom...

Next Auth CognitoProvider Internal Library: https://github.com/nextauthjs/next-auth/blob/v4/packages/next-auth/src/providers/cognito.ts

I mentioned this in an age-old discussion on NextAuth GitHub repo.

Authentication is a fundamental part of most web applications. Integrating authentication into your Next.js app can be simplified with NextAuth, a powerful authentication library that supports various authentication methods. However, the documentation around setting up NextAuth with the "Credentials" auth provider might not be as clear as you'd hope. My implementation is greatly enriched and partially based on Next-Auth docs and the following github thread.

For Auth: https://authjs.dev/ - works like a charm with Svelte https://authjs.dev/reference/sveltekit

NextAuth.js

I'm surprised nobody mentioned https://authjs.dev/