I want to let users log in to my proof-of-concept Web app. However, I don't want to maintain a fully-fledged authentication solution, managing logins, passwords, OAuth tokens, and their recovery.<p>Ideally, I'd like to receive a unique user token and allow one to log in back if they decide to return. I don't need any user metadata.<p>OpenID requires quite an effort and a provider like Google or Okta. The most-matching concept was Mozilla Persona, but it was shut down in 2016.<p>What is the better way to implement this? Should I stick to the plain old login-password combination?
Full disclosure, I work for a fully-fledged authentication solution (FusionAuth) and if your PoC succeeds, my guess is you'll look to make a move to a similar solution. But I understand your desire to go quick and dirty.<p>You didn't provide a ton of details (the programming language affects library options, for example) but I would go one of the following ways:<p>* login with a social provider like google, facebook or github. I don't know what your audience is, but hopefully you know which of these (or any other) would have the most uptake. This delegates the entire authentication process to a third party and allows the user to choose the level of security they want around their account without involving you at all.<p>* look for an OSS library in your language that offers magic token login. This is what you are describing when you talk about the token. Implement that. If you can find such a library, this will be a simpler solution.<p>> What is the better way to implement this? Should I stick to the plain old login-password combination?<p>I'm not your user and we don't have any idea what your userbase is. I'd ask them. Lots of tech folks want a username and password so they can use a password manager. Non-tech folks would probably prefer one of the two above options.
An excellent women's soccer publication, Equalizer Soccer [1], which seems to use Memberful, has the authentication system I want EVERY non-critical publisher/app to use-<p>1. enter email address<p>2. email me a signin link<p>3. i click the link<p>4. i am in, on whatever device i am using<p>There is no password and no needed coordination with my password management.<p>It is glorious.<p>1. <a href="https://equalizersoccer.com/" rel="nofollow">https://equalizersoccer.com/</a>
For PoC Firebase Authentication<p><a href="https://firebase.google.com/docs/auth" rel="nofollow">https://firebase.google.com/docs/auth</a><p>You get hosted + UI + OAuth<p>There are many others:<p><a href="https://supabase.com/docs/guides/auth/overview">https://supabase.com/docs/guides/auth/overview</a><p><a href="https://www.keycloak.org/" rel="nofollow">https://www.keycloak.org/</a><p><a href="https://www.permify.co/" rel="nofollow">https://www.permify.co/</a><p>...<p>..
Magic email links essentially transfer "managing logins, passwords, OAuth tokens, and their recovery" to the user's email provider.<p>Many auth providers support magic links. I recommend <a href="https://userfront.com/dashboard/authentication" rel="nofollow">https://userfront.com/dashboard/authentication</a>
Hey, we've built exactly what you are describing: <a href="https://www.hanko.io" rel="nofollow">https://www.hanko.io</a><p>You can go with either self-hosted or cloud. Cloud is free for up to 100 users.<p>If you have any questions along the way: <a href="https://www.hanko.io/community" rel="nofollow">https://www.hanko.io/community</a>
For a personal webapp accessed from a few devices I just keep a list of session IDs in the app's config file. The web framework generates the session id, it's derived from a cookie with no expiry.<p>There's a "/register" page that just has a mailto: link to email myself, with the session ID in the mailto email body parameter. Easy to copy-paste into the config file when setting up a new device.<p>This is probably less useful for external users (who want to log in extra devices themselves), but something similar might work.
Something I wish exist is a solution that truly use my own tables and support multi-tenant. So you only configure the connection string and some SQL templates and that is all.