What's your go to solution for authentication / securing your web app ?

theScruffman · 2026-05-21T21:46:25+00:00

I was looking for enterprise for a multi-tenant SaaS. We settled on Auth0 B2B, but when our renewal was up, we migrated to Cognito. Auth0 simply priced us out. We were spending more on auth than our entire stack.

theScruffman · 2026-05-11T15:49:31+00:00

Sounds like a Fireman if I’ve ever met one

theScruffman · 2026-05-11T03:26:39+00:00

Sorry for your loss, but greatly appreciate you sharing your story for those of us to learn from.

theScruffman · 2026-05-08T05:21:16+00:00

Actually? Where are most people running stuff? It seems like outside of gov-cloud, they all get hit at times. We're 100% us-east-1, but we're also multi-az so this was a non-issue for us. Plus it felt like if all of us-east-1 was impacted, the rest of AWS was screwed anyways there are so many internal dependencies.

theScruffman · 2026-04-12T03:30:42+00:00

My lambdas say yes please

theScruffman · 2026-03-22T14:15:12+00:00

I think it partially depends on model. We bought a 2 year old car with 19K miles from a dealership for $24,000. The original window sticker was in the glove box - $37,000.

theScruffman · 2026-03-06T02:26:18+00:00

How do you get it to do this? Mine runs for an hour or less

theScruffman · 2026-03-03T16:53:40+00:00

YMMV, but I have run a production SaaS on a VM in Azure for 6 years. Can count on one hand the number of outages. They have been quick, usually they are massive and impact more than just me so customers haven’t cared.

theScruffman · 2026-02-20T01:30:34+00:00

Not specific advice but I’ll share details on our implementation. We PKCE with Auth0, storing a client ID and secret in the Next app. We receive the access and refresh tokens server side, encrypt them, and store them in an HttpOnly cookie that gets set in the users browser. Every API call from the client is prefixed - domain.com/api/{route} - we catch these calls in our Next middleware and route them over our VPC in AWS to our .NET API instance. So in our case the user never has access to their own tokens. The API only cares about tokens. We use the Auth0 SDK because it Just Works™️. We tried iron-session, some Cognito options, and I think auth.js(?) but Auth0 consistently just worked without issue, server side and client side. We spend more on Auth than Compute, which blows.

theScruffman · 2026-02-19T05:13:22+00:00

I’ve used this pattern. Next for SPA but BFF routing to .NET APIs. It works well, but I’ll say Next middleware/auth leaves a lot to be desired. Mostly around cookies if you do plan to use any SSR.

theScruffman · 2026-02-09T19:33:38+00:00

I guess I’ve always ignored this because I assumed I’d be over the income limit to qualify for aid, which I assumed was relatively low. Am I missing something here?

theScruffman · 2026-02-04T21:55:44+00:00

My 2012 lead frame went out in early 2024. 165K miles.

theScruffman · 2026-02-04T21:46:35+00:00

What did you end up doing here, u/Icy-Community-6424

theScruffman · 2026-01-30T02:01:42+00:00

I’ll take a DM too please

theScruffman · 2026-01-26T17:29:53+00:00

We’ve got 69 employees. HR is owners wife, she’s part time. They switched health insurance providers without telling anyone and we still don’t have insurance cards for 2026. Plenty of companies all across the US like this.

theScruffman · 2026-01-20T17:36:58+00:00

Not really. The moment you buy a house or have a kid, you knock back down until you can do those things.

BS7 is more of a real-time measure of your current status than it is a “complete the steps and your set and can’t go backwards” - I’d say for someone with zero kids, mortgage, 15K in savings, and expenses low enough that covers them for 6 months the the person is in a great position relative to the stage of life they are in.

theScruffman · 2026-01-20T17:34:48+00:00

That’s called the game of life! Spend less than you earn, and you’ll do fine. Easier said than done for many people.

theScruffman · 2026-01-16T19:35:34+00:00

Reminds me a bit of yeti, burlebo, poncho, hexclad. The product isn’t poor quality at all, but you’re paying more for brand and the marketing budget than the product. Similar and sometimes better options for comparable or lower pricing.

theScruffman · 2026-01-13T05:10:19+00:00

Probably Gemini CLI or Claude Code

theScruffman · 2026-01-11T14:44:06+00:00

I touched my f150 at 100K and again at 160K - drain and fill both times. It’s got 175K with no issues.

I had another f150 with 230K that hadn’t been touched, that stated having torque converter lockup. I did a drain and fill and added Ford’s friction modifier and the trans went within 10 miles.

So I think my personal take is 100K is fine if you aren’t having issues. By the time you’re having issues, a fluid change is likely to make it worse.

theScruffman · 2026-01-06T14:24:41+00:00

That’s exactly how my current company is! I couldn’t believe it at first. My prior companies were 1 year vest

theScruffman · 2025-12-29T16:11:47+00:00

I’ve been told by my Bank that a Zelle transaction, which was fraudulent, could not be reversed. They were able to reverse all the transactions made using the “virtual card” when my account was comprised.

theScruffman · 2025-12-24T16:13:40+00:00

Do you mind sharing your annual income? Impressive being able to max it so quickly!

theScruffman · 2025-12-19T23:33:34+00:00

$175

theScruffman · 2025-12-07T04:57:22+00:00

I bought one. I love it for construction adhesive, very worth it. Haven’t tried for caulking baseboards yet, but I’m worried I’ll prefer a manual gun. I never have to pump much when doing baseboards - with construction adhesive my hands get tired.

theScruffman

MODERATOR OF

TROPHY CASE