HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
FusionAuth
fusionauth-issues
OPEN SOURCE2019–2026
FusionAuth / fusionauth-issues

fusionauth-issues

FusionAuth issue submission project

Explore on GitHubRead Hacker News discussions
5Distinct people
27Mentions
0Explicit recommenders
93GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

FusionAuth issue submission project

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year27 dated mentions

Observed mentions: 2019-01-23 21:38:07 UTC to 2026-06-19 11:26:43 UTC.

02462019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC101
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC606
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC615
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC505
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC514
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

27 sources
mooreds·Jun 19, 2026
Yeah, I recently documented how to use pre-registered clients with FusionAuth[0] (my employer). DCR's newer, better sibling CIMD is on our radar and under active discussion[1], but not currently available. An alternative to the proxy you suggest is to generate a new Entra client id (with PKCE enabled) for every MCP client in a developer portal or similar, then have the user configure their client with that client id. Here's the CLI command I found to do this[2], but I bet there's an API too. Here are config instructions for Claude Code[3] and ChatGPT[4]. Client pre-registration is acceptable, but not optimal, for developers, and is a first class citizen in the spec[5]. If your main audience is internal and you can expect them to follow configuration instructions to get access to the MCP server, this approach can work. But it's definitely
Read the rest
not acceptable for widespread, public integrations if your audience is not developers. That is where a lot of the power and opportunity for MCP lies. 0: https://fusionauth.io/docs/extend/examples/controlling-acces... 1: https://github.com/FusionAuth/fusionauth-issues/issues/3230 2: https://learn.microsoft.com/en-us/cli/azure/ad/app?view=azur... 3: https://code.claude.com/docs/en/mcp 4: https://developers.openai.com/api/docs/guides/developer-mode 5: https://modelcontextprotocol.io/specification/2025-11-25/bas...
In Zero-Touch OAuth for MCP
mooreds·Nov 21, 2025
I work for FusionAuth. We have lambdas (basically JavaScript code that can make API calls[0] and be managed and tested[1]) that execute at fixed points in the auth lifecycle: - before a login is allowed - before a token is created - after a user returns from a federated login (SAML, OIDC, etc) - before a user registers And more[2]. And we're currently working on one for "before an MFA challenge is issued"[3]. There are some limitations[4]. We don't allow, for instance, loading of arbitrary JavaScript libraries. Not sure if that meets all your needs, but thought it was worth mentioning. 0: https://fusionauth.io/docs/extend/code/lambdas/lambda-remote... 1: https://fusionauth.io/docs/extend/code/lambdas/testing 2: full list here: https://fusionauth.io/docs/extend/code/lambdas/ 3: https://github.com/FusionAuth/fusionauth-issues/issues/2309 4:
Read the rest
https://fusionauth.io/docs/extend/code/lambdas/#limitations
In Okta's NextJS-0auth troubles
mooreds·May 26, 2025
> OAuth forces the usage of JWT. OAuth doesn't, OIDC does for the ID token[0]. OAuth, at least the inital RFCs, were released 3 years before JWT was defined. But many extensions of OAuth do require or support JWTs. Either way, I'm just not sure the demand is there. My employer has had an open issue for Pasteo[1] for years but hasn't seen much community support. Some other interesting comments here[2]. Looks like most of the implementations[3] are libraries rather than standalone auth servers. 0: https://openid.net/specs/openid-connect-core-1_0.html#IDToke... 1: https://github.com/fusionAuth/fusionauth-issues/issues/773 2: https://www.reddit.com/r/KeyCloak/comments/1e2h5w7/is_paseto... 3: https://paseto.io/
In Ten years of JSON Web Token and preparing for the future
mooreds·May 26, 2025
https://datatracker.ietf.org/doc/html/rfc7009 handles generic revocation without specifying implementation details. Some auth servers implement it. Keycloak does[0]. Auth0 doesn't as far as I can tell[1]. FusionAuth (my employer) has had it listed as a possible feature for years[2] but it never has had the community feedback to bubble it up to the top of our todo list. 0: https://www.keycloak.org/securing-apps/oidc-layers#_token_re... 1: https://auth0.com/docs/secure/tokens/revoke-tokens 2: https://github.com/fusionAuth/fusionauth-issues/issues/201
In Ten years of JSON Web Token and preparing for the future
mooreds·Oct 7, 2024
> It just feels brittle and if your email provider attempts to scan urls to see where they actually go you end up giving them an auth token and by the time the user clicks the link it's invalidated (or you don't invalidate the link at all which is worse). At my current employer (an auth vendor) we ended up changing our magic link behavior to require a post from the user to log in because of this issue (the scanners didn't get an auth token, but they did invalidate the one-time code and confuse end users to no end. If you want more details, there is some discussion here: https://github.com/FusionAuth/fusionauth-issues/issues/2443 and on the related issues.
In Ask HN: What type of Auth are you using on your side projects?
mooreds·Sep 27, 2024
Also worth noting that per the spec, the RelayState can only be 80 bytes. > As well in "HTTP Redirect Binding" or "HTTP POST Binding", The RelayState value MUST NOT exceed 80 bytes From https://docs.oasis-open.org/security/saml/v2.0/saml-bindings... At FusionAuth, we have an open issue for this: https://github.com/FusionAuth/fusionauth-issues/issues/2467 which you can read for more details. SAML is full of these kinds of gotchas. We have an open source library which provides Java SAML bindings: https://github.com/FusionAuth/fusionauth-samlv2
In SAML: A Technical Primer
mooreds·Feb 22, 2024
Gotcha. We definitely don't have fine granularity around when MFA is required (open issue here: https://github.com/FusionAuth/fusionauth-issues/issues/2285 ). Other than that I'd suggest putting a page in front of our login pages with the domain logic, and modeling each set of emails as either an application, organization or tenant, depending on the specific features you need. Either way, hope you find the right solution for your needs!
In Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
mooreds·Feb 11, 2024
Great question. Appreciate the interest. I can only speak from my perspective as an employee, not the whole company. It is something I've thought about. I will also ask the CEO/founder or other leaders to weigh in. Many devs care about open source when they are evaluating a solution, but many really want "free as in beer". They want to try a product without getting out the credit card or engaging with sales. We cater to the latter category, which wants to understand the product quality without talking to any sales people. Some of these folks use our community product for their production needs, which is perfectly fine. We have people running FusionAuth in production with 1000s of tenants or 10000+ applications. (I always say they "pay" us by filing bug reports, giving feedback and voting on feature requests.) But some decide they want to
Read the rest
pay us for hosting, support or advanced features. Those choices help us build a business. Devs, and especially buyers, are interested in sustainability of a product they are going to integrate into their system. An auth provider isn't a javascript widget that you can easily drop in or remove from your system. It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. You want to be sure the company and product is going to stick around. (If you want to make sure you can run the product even if everyone at FusionAuth wins the lottery, we do offer source code escrow for a price, but haven't had anyone take us up on it.) FusionAuth is a profitable company (we did recently raise a round to accelerate growth, you can read more about that here [0]). Open source companies often have a hard time meeting the profit goals of the market or investors. This is a known issue and often results in relicensing or changing the rules, as we've seen with Hashicorp[1] and Elastic[2]. This switcheroo can cause issues, confusion, and ill-will; FusionAuth's licensing avoids that. FusionAuth also develops in the open[3]. This open development process gives us another common benefit people get from OSS--community feedback. Also, I don't want to throw shade at Ory and Zitadel, since I have no idea about their finances (apart from a brief look at Crunchbase, which shows they've raised 22.5M[4] and 2.5M[5] respectively). I hope they're building sustainable businesses, but selling closed source software is a sure route to a profitable business that has built many big companies (including in the auth space, such as Okta or Auth0). Again, this is not FUD (or at least I don't intend it to be!), just an honest assessment at the difficulties of making money in open source dev tools [6]. We also compete on features, support and documentation. Again, I can't speak to Ory or Zitadel; they look nice, but I haven't built anything with them, so it is hard for me to know how good they are. I do know that we have had many clients appreciate of those aspects of our product. To sum up: * FusionAuth has a free option, which helps reduce friction and gives some of the benefits of OSS. The open process and escrow also give some of the benefits of OSS. * Some devs and buyers care about business sustainability, especially when integrating a tool deeply into their application. FusionAuth will never have to worry about relicensing a version because AWS is eating our SaaS revenue stream, for example. * We offer great support, documentation and intricate auth features at a reasonable price. Hope this helps. 0: https://fusionauth.io/blog/fusionauth-and-updata 1: https://www.hashicorp.com/license-faq 2: https://www.elastic.co/pricing/faq/licensing 3: https://github.com/FusionAuth/fusionauth-issues/issues/ 4: https://www.crunchbase.com/organization/ory/company_overview... 5: https://www.crunchbase.com/organization/zitadel 6: I wrote about this a few years ago on my personal blog: https://www.mooreds.com/wordpress/archives/3438
In Keycloak SSO with Docker Compose and Nginx
mooreds·Jan 23, 2024
We have a lot of issues (nearing 1000) in a public repo[0] that anyone can view and vote on. This gives us a natural filtering mechanism for community input. We regularly sort this by number of upvotes. It also lets our users submit some off the wall ideas, and gives a way for low friction community feedback to be captured. Finally, it lets community members easily be notified when a feature is delivered by subscribing to the issue. We also have a separate, private list of commits to customers. (The commit is public and is added to a milestone, but the customer is private.) We also group issues by theme[1]. It's not perfect but it's an attempt to make sure we don't run into the duplicates issue you mention. It allows the eng team to address multiple issues in the same area of the code at once. I understand what you are saying about clutte
Read the rest
r, but the low cost public feedback and tight loop between issue and code is worth some issue creep, IMO. 0: https://github.com/FusionAuth/fusionauth-issues/issues 1: https://github.com/FusionAuth/fusionauth-issues/issues?q=is%...
In Backlog size is inversely proportional to how often we talk to customers
mooreds·Apr 19, 2023
Disclosure, I work for FusionAuth. > Multi-tenant (each of my customers gets a fully separate directory, with access to all tenants for our admins) Yup. > SAML and OAuth (customers can set up SAML themselves via the SaaS interface, or we set the SP up for them) You'd have to build an interface using our APIs for this. Not available out of the box, but we do have it in the general roadmap (https://github.com/fusionauth/fusionauth-issues/issues/91 is the tracking issue). > Rule based group assignment based on SAML attribute evaluation (e.g. assign users to this group if the attribute X = Y) You could do this with Lambda HTTP Connect (a paid feature) or webhooks (a free feature. https://fusionauth.io/docs/v1/tech/lambdas/#using-lambda-htt... has more > APIs to manage users, groups, organisations (tenants) Yup. > SAML Federations like InCommo
Read the rest
n... Hmmm. We have an open issue for supporting this, but I'm not sure what is involved. If it is straight SAML, it should work, but SAML is pretty ... multi-facted so testing would be needed.
In Show HN: Kinde – auth, feature flags and billing (Q3) in one integration
mooreds·Dec 30, 2022
My employer (FusionAuth) has the same feature in our community edition and it's quite popular: https://fusionauth.io/docs/v1/tech/passwordless/magic-links It is glorious from the user perspective, but there are actually some subtleties from the implementation perspective that caused us some grief. First of all, you have email configuration and deliverability. The answer is to outsource it to a provider like Sendgrid, SES, or Mailgun. Then, there's anti phishing email software which can expire one time tokens as it probes to prevent phishing attacks. More on how we built around that here: https://github.com/FusionAuth/fusionauth-issues/issues/629
In Ask HN: Lightweight Authentication
mooreds·Oct 11, 2022
> just invalidate them after use I can't speak for Stytch, but I know at $CURJOB, we have run into issues with this where corporate phishing protection software invalidates one time use codes. I believe it does that because it retrieves links in emails before the user clicks on them. This was an issue several of our customers have raised. So it isn't as straightforward as you might think. There's more details, including the workaround we ended up using, on the GH issue: https://github.com/FusionAuth/fusionauth-issues/issues/629 PS I agree they should absolutely have guidance around link lifetime as well as safe defaults. Converting the links to one-time use seems like a good start.
In Tell HN: Stytch Login SaaS Unicorn has common auth vulnerabilities

Showing the 15 most recent of 27 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.