Even though I'm working within .Net Core, this question is generally applicable to other platforms as well.
My question is to do with: Using a framework (such as IdentityServer) to manage implementation for Auth (Authentication/Authorisation) -- Vs -- rolling out your own implementation by following protocols. In this scenario, the 'rolling out your own' option wouldn't rely on any middleware to manage auth - all the required endpoints/services/data-access would be self managed.
Specifically, I'd like to know: assuming you have followed the protocol specs, what are the security concerns when rolling out your own implementation?
Edit 1: For further context, the only thing in question that requires implementation here, is a microservice responsible for authenticating using the OAuth authorisation code flow and nothing more. No sessions, as there’s no associated website with ‘protected resources’ and no ‘currently logged in user’. As per the authorisation code flow:
Authenticate: Endpoint to login and redirect to return url with authorisation code.
Question 1: Even if I use a framework, I still have to verify the client against those registered in my database, present the view with the login form, use CSRF action filters, validate input against my user database, and store the authorisation code in my database against the authenticated user for token exchange later. So what further security concerns arise from not using a framework?
Authorise: Endpoint to receive authorisation code and respond with tokens.
Question 2: Even if I use a framework, I still have to lookup the code in my database, check if it’s expired, store the access/refresh tokens in my database, and respond with the generated tokens. So again, what further security concerns arise from not using a framework?