Ory Kratos VS auth0-spa-js

I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it?

https://github.com/ory/kratos

I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited (https://github.com/ory/kratos/graphs/code-frequency) so I might have had a bad first impression.

A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I dont know if the owner are going to merge it.

An example that comes to mind is the OAuth email auto-verification or the search of users that is still super basic (we only recently got the filter of identifiers).

IMO it's almost always good to offer some OIDC social login, just depends what provider your users use.

- https://github.com/ory/kratos

Check out the milestone on github: https://github.com/ory/kratos/milestone/15

not sure if that is everything.

An open source solution pre-built from professionals like Ory Kratos or Keycloak saves you a lot of time and pain.

https://github.com/ory/kratos

Your message feels disingenuous and not in good-faith.

Auth0 clearly advises against the localStorage option which is most similar to Stytch's:

> _Important:_ This feature will allow the caching of data _such as ID and access tokens_ to be stored in local storage. Exercising this option changes the security characteristics of your application and _should not be used lightly._ Extra care should be taken to mitigate against XSS attacks and minimize the risk of tokens being stolen from local storage.

This is from the readme of the github you linked:

https://github.com/auth0/auth0-spa-js/tree/0de9c6bf61d37fc21...

And since their other client-only solutions have major UX challenges (as you highlight), I expect most Auth0 users have landed on the secure option.

This is very different from Stytch - which as far as I can tell - doesn't disclose or acknowledge the risk, and instead willingly puts developers at increased risk. Throughout this thread, you've been dismissive of the risk despite security organizations clearly indicating that HttpOnly is best-practice.

You've found a legitimate comparison in Firebase, but for me, you've taken several steps too far trying to compare to Auth0.

Auth0 provides the auth0-spa-js package which offers two ways to authenticate users:

Therefore, I have transformed the library [@auth0/auth0-spa-js](https://github.com/auth0/auth0-spa-js), which is another official Auth0 client library, to have an authentication hook and methods that can be accessible outside the components.

auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/master/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information. 32 | it("renders a login button", () => { 33 | > 34 | const { getByText } = render( | ^ 35 | 36 | 37 |