I want to post an answer here for future references.
This is mainly for developers who are developing hybrid apps, native apps (ios,Android) and Progressive web apps (PWA).
Most common technologies used with those types of apps (not exclusive) :
- Cordova
- Nodejs
- Vue
- React
- Javascript
- JSON
- socket.io (websockets)
Most common databases used (not exclusive) :
- Firebase
- MongoDB
- PostgreSQL (still RDBMS but offering support for json/jsonb)
When it comes to me Im using Nodejs, javascript for front-end,
storing JSON/JSONB in PostgreSQL and socket.io to listen for updates in my database which allows me to create real-time apps.
At first when I was asked to migrate our app to a more performant and efficient technology, I had no idea what to look for in terms of security but I knew I wanted something more
- secure
- efficient
- performant
- less error prone
Coming from a PHP/MYSQL background, I realized I had to unlearn a lot
of bad habits that I'm still unlearning at the moment.
Things I have to let go of to meet all above requirements :
- password hashing : md5(), sha1(), hash()
- username matching
But what's wrong with password hashing and username matching, you may ask?
The short answer : it's error prone, inefficient and very synchronous
The solutions
I found actually 2 solutions to creating more secure and efficient oAuth systems in your apps. Your login and registration systems don't have to be a pain to write.
Solution #1 : JSON Web Tokens (OpenID Connect)
If you are already making heavy used of Javascript in your software, especially JSON and the technologies I've mentioned above, learning to work with JSON Web Tokens (JWT) is standard practice these days. JWT are also certified and follow the OpenID Connect protocols which means any app using JWT is compliant according to the oAuth 2.0.
JSON Web Tokens are an open, industry standard RFC 7519 method for
representing claims securely between two parties. JWT.IO allows you to
decode, verify and generate JWT.
Read more here
Benefits and advantages of tokens
- create two factor authentication systems (email, username + tokens)
- single sign-on systems
- security compliant
- standard usage of oAuth protocols
Disadvantage of tokens
Solution #2 : authentication-as-a-service
If you don't want to handle registration and login on your own for security issues, you can safely turn to a third party who will handle it in the background for you and all you have to do is connect your app using their API.
Authentication as a Service (AaaS) provides authentication services
like multi-factor authentication, single sign-on, and password
management in the cloud. With Authentication as a Service,
organizations can control access to their applications and servers
from various devices and networks.
There are several different AaaS around, but during my research, the one I found to be open source and free to an extent is auth0.
I'm not using auth0 services nor do I work with them nor am I
affiliated to them in any way. This is for education purposes only.
Benefits and advantages of AaaS
- secure out-of-the box solution
- human friendly with dashboard and user management
- remote hosting
- Easy API docs
Disadvantages of AaaS
- must rely on third party service
- Can be pricy in the long run (not exactly open source)
Open Source Projects
Great alternatives to expensive AaaS. The MAJOR plus is that they are self-hosted which means YOU own the data no third party.
- GLUU Server
- SuperTokens
- NextAuth.js (React)
- ORY.sh