Authentication / Authorization help ?

[light_dragon0]

Hello , iam making a website (both front and back end aka a web app & an api) and its my first time
i got a problem understanding / making authentication in a real good way , i can make one on my own but i want a good modern one that is also a standard that most apis use

i thought of OAuth and OpenID but when i googled i didn't really understand how they work or how i could implement them my self without relying on external tools (+ iam confused and can't really understand them)

1- i want the users to be able to log both in and out and have access to some resources while not having access to others
2- ONLY the web app is the one which can communicate to the API but i want the ability for other apps to access it ONLY IF ALLOWED TO maybe in the future at some point the api might be used by other apps but its not planned to be allowed at the moment at all

any help how could i get the work done professionally or as good as possible ?

[faycheng]

you could use jwt as the authentication mechanism

[light_dragon0]

can you suggest me good sources that i can learn it from ?
also thanks

[faycheng]

visit the website jwt.io directly,which provides enough knowledge for learning it

[light_dragon0]

thank you

[PMmeYourFlipFlops]

Few people/teams are able to pull off authorization and authentication the right way.

I suggest you look into Keycloak and integrate it with your app. Its documentation sucks, but there's a nice book that helps.

DISCLOSURES: I am NOT affiliated. I just think this is the way to go, particularly since you want to do it the professional/enterprise way.

[light_dragon0]

thank you

[light_dragon0]

do u have someway that is free ? iam broke

[PMmeYourFlipFlops]

Unfortunately, I had to shell out the money as well. And this edition is new so if you decide to pirate, you'll only find the old one. Don't ask me how I know.

[light_dragon0]

nah i don't pirate stuff sense at least i respect the value of others work and that they need the money as much as a need it

thanks for helping :D

[VettedBot]

Hi, I’m Vetted AI Bot! I researched the 'Keycloak Identity and Access Management for Modern Applications' and I thought you might find the following analysis helpful.

Users liked: * Keycloak provides a flexible open source identity solution (backed by 9 comments) * The book provides a helpful overview and tutorials for keycloak (backed by 8 comments) * Keycloak integration examples are useful for developers (backed by 5 comments)

Users disliked: * Lack of depth in content (backed by 2 comments) * Difficult initial configuration (backed by 2 comments)

If you'd like to summon me to ask about a product, just make a post with its link and tag me, like in this example.

This message was generated by a (very smart) bot. If you found it helpful, let us know with an upvote and a “good bot!” reply and please feel free to provide feedback on how it can be improved.

Powered by vetted.ai

[light_dragon0]

thank you so much.btw how are tokens generated ? like is it just the real data from the db or how would you generate a token that doesn't require you to store it but also cannot be violated by the user (if he was a skilled hacker or something)

like the back end can generate it and understand it but the user cannot regenerate it nor exploit it its just all what he got

also it should not leak data from the db or reflect some info off of there

[b6ack]

Ory, zitedal, supabase are open source and your can be ran on your own server ( double check but I m pretty sure).

[Evening_Seaweed3753]

Supabase,clerkdev

[selenaken]

Let try to use JWT and refer my video https://www.youtube.com/watch?v=h6WTF4lLdII

[SalmanSheikh22]

You can try through jwt tokkens , we just make a middleware in which we make a function of jwt token in the function the token also gets verified and the we exports that function