Auth isn't rocket science - I'd encourage people to recommend well-guided DIY here for newer developers in a lot of cases, because foundational tech learning experiences are critical to growing as a developer.
There's value to many in SaaS offerings, but any decently-sized programming ecosystem has a crap ton of auth offerings. e.g. Devise [0], Dotnet Identity [1], Django Auth [2]. Authorization is the fiddly/annoying part. For authentication, a reasonably motivated developer can expect to have workable, secure password authentication going in a couple hours, as long as they don't try to invent their own encryption scheme.
[0]: https://github.com/plataformatec/devise
[1]: https://docs.microsoft.com/en-us/aspnet/core/security/authen...
[2]: https://docs.djangoproject.com/en/2.1/topics/auth/
In Ask HN: What do you use for authentication and authorization?heartcombo
devise
Ruby2010–2026
heartcombo / devise
devise
Flexible authentication solution for Rails with Warden.
44Distinct people
46Mentions
0Explicit recommenders
24.3KGitHub stars
What to know before exploring
What it is
Flexible authentication solution for Rails with Warden.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- binarylogic/authlogic · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:59:53 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year46 dated mentions
Observed mentions: 2010-05-05 02:40:10 UTC to 2026-05-29 19:54:00 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2010 | 2010-01-01 00:00:00 UTC | 2011-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Devise is a flexible authentication solution for Rails based on Warden. It:
Is Rack based;
Is a complete MVC solution based on Rails engines;
Allows you to have multiple models signed in at the same time;
Is based on a modularity concept: use only what you really need.
It's composed of 10 modules:
Database Authenticatable: hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
Omniauthable: adds OmniAuth (https://github.com/omniauth/omniauth) support.
Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
Recoverable: resets the user password and sends reset instructions.
Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
Trackable: tracks sign in count, timestamps and IP address.
Timeoutable: expires sessions that have not been active in a specified period of time.
Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
Table of Contents
Information
The Devise wiki
Bug reports
StackOverflow and Mailing List
RDocs
Example applications
Extensions
Supported Ruby / Rails versions
Contributing
Starting with Rails?
Getting started
Controller filters and helpers
Configuring Models
Strong Parameters
Configuring views
Configuring controllers
Configuring routes
I18n
Test helpers
Controller tests
Integration tests
OmniAuth
Configuring multiple models
Active Job Integration
Password reset tokens and Rails logs
Other ORMs
Rails API mode
Additional information
Warden
License
Information
The Devise wiki
The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README:
https://github.com/heartcombo/devise/wiki
Bug reports
If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report:
https://github.com/heartcombo/devise/wiki/Bug-reports
If you have discovered a security related bug, please do NOT use the GitHub issue tracker. Send an email to heartcombo.oss@gmail.com.
StackOverflow and Mailing List
If you have any questions, comments, or concerns, please use StackOverflow instead of the GitHub issue tracker:
https://stackoverflow.com/questions/tagged/devise
The deprecated mailing lists can still be read on:
https://groups.google.com/group/plataformatec-devise
https://groups.google.com/group/heartcombo
RDocs
You can view the Devise documentation in RDoc format here:
https://rubydoc.info/github/heartcombo/devise/main/frames
If you need to use Devise with previous versions of Rails, you can always run "gem server" from the command line after you install the gem to access the old documentation.
Example applications
There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here:
https://github.com/heartcombo/devise/wiki/Example-Applications
Extensions
Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here:
https://github.com/heartcombo/devise/wiki/Extensions
Supported Ruby / Rails versions
We intend to maintain support for all Ruby / Rails versions that haven't reached end-of-life.
For more information about specific versions please check Ruby
and Rails maintenance policies, and our test matrix.
Contributing
We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started:
https://github.com/heartcombo/devise/wiki/Contributing
You will usually want to write tests for your changes. To run the test suite, go into Devise's top-level directory and run bundle install and bin/test.
Devise works with multiple Ruby and Rails versions, and ActiveRecord and Mongoid ORMs, which means you can run the test suite with some modifiers: DEVISE_ORM and BUNDLE_GEMFILE.
DEVISE_ORM
Since Devise supports both Mongoid and ActiveRecord, we rely on this variable to run specific code for each ORM.
The default value of DEVISE_ORM is active_record. To run the tests for Mongoid, you can pass mongoid:
DEVISE_ORM=mongoid bin/test
==> Devise.orm = :mongoid
When running the tests for Mongoid, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
Please note that the command output will show the variable value being used.
BUNDLE_GEMFILE
We can use this variable to tell bundler what Gemfile it should use (instead of the one in the current directory).
Inside the gemfiles directory, we have one for each version of Rails we support. When you send us a pull request, it may happen that the test suite breaks using some of them. If that's the case, you can simulate the same environment using the BUNDLE_GEMFILE variable.
For example, if the tests broke using Ruby 3.4 and Rails 8.0, you can do the following:
chruby 3.4.0 # or rbenv shell 3.4.0, or rvm use 3.4.0, etc.
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bin/test
You can also combine both of them if the tests broke for Mongoid:
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 bundle install
BUNDLE_GEMFILE=gemfiles/Gemfile-rails-8-0 DEVISE_ORM=mongoid bin/test
Running tests
Devise uses minitest as test framework.
Running all tests:
bin/test
Running tests for an specific file:
bin/test test/m
Read the full README on GitHubWhat Hacker News says
5 sourcesIt's not a matter of how many packages are required; that isn't the issue. The reason "30 random npm packages" doesn't satisfy the requirement while Rails does is that Rails provides a high-level framework for integrating those disparate packages into a single cohesive application, while with npm packages you have to write that framework yourself.
Perhaps the best example I can give for this difference is Devise, an authentication plugin for Rails. Have a look at the instructions for setting up Devise on Rails: https://github.com/plataformatec/devise#getting-started You just add the dependency and boom, you instantly get a database migration for storing authentication data in your database, automatic integration with Rails's email notification system, a single command you can run to generate all boilerplate files, and a single line of cod
Read the rest
e you can add to your controllers to automatically enforce authentication for any particular action. With a similar authentication package in a Node application you'd most certainly have to set all that up manually.
I work in a lot of Django shops and my Ruby is nowhere near as good as my Python but I'll pick Rails every time if I'm working on a side project. Why? Because the development velocity when using it is unparalleled. I can have an MVP up orders of magnitude quicker than I can with Django/Flask/Twisted. You're absolutely right on the Admin interface and auth, but auth is a gem install away [1] and Django's admin won't fit my requirements more often than it helps; I can seldom justify exposing it to end users and it's a hideous undertaking to extend it meaningfully (I gather this is one of the reasons it is a bit of a laggard compared with the rest of the framework. We only got mobile support out the box in 2.0 for example [2]).
Other reasons I enjoy Rails:
- Scaffolds allow me to have CRUD support for any model I want with one command (combi
Read the rest
ned with auth, I have Django's admin, more or less)
- JSON views without a third party library (surely this is pretty standard for a web framework in 2018 in most cases?)
Other reasons I don't enjoy Django so much:
- I can't think of an eloquent way to phrase this but Rails values my time. With Django I'm doing menial minutiae like creating a directory for my app's templates before it'll serve a page. Why? I know 'magic' is anathema to the Python community but context switches like this shouldn't be there when I'm trying to get an app up and running at speed
- I feel like it's stewardship is bordering on begrudging: Why are websockets (and JSON for that matter, but I've touched on that) not present in a 'kitchen-sink' web framework? I'm not sure why we're worrying about master/slave DB terminology [3] when there are axiomatically more pressing technical and adoption-related issues at hand.
Django is a fine web framework, and perhaps the best-in-breed for Python, but it feels miles behind where it should be at this point and I'm not really sure why.
[1] - https://github.com/plataformatec/devise
[2] - https://docs.djangoproject.com/en/2.1/releases/2.0/#mobile-f...
[3] - https://github.com/django/django/pull/2692
Sinatra[1] is more like Flask. From your list Rails has an ORM (ActiveRecord) and built in ActionView form helpers, but no default admin interface or authentication. The standard authentication library in the community is usually Devise[2]. What ‘etc’ includes is difficult to comment on :)
[1] http://sinatrarb.com/
[2] https://github.com/plataformatec/devise
In Ask HN: Django or Rails?First of all, I don't think there is anything out there that could beat Java + IntelliJ + Spring boot.
It does not matter if you use WebStorm, Clion, Rider ?, one must admit that IntelliJ is a Java IDE at its heart.
It's very hard to describe how amazing the tooling is because you cannot describe a color to blind people.
This is not meant to be offensive.
There is one way I could at least try it.
If you are using Vim/Emacs and everything feels like 'flying', that feeling multiplied by 3.
That's what IntelliJ + Java is.
If you then also install the Vim plugin, you got the best of both worlds.
I did asp.net mvc with C# and VS, it's not even close.
I did Rails a few years, not comparable ...
I tried to so many languages and frameworks, nothing comes even close to IntelliJ+Java+Spring boot.
Since I'm already procrastinating, I'd like to ki
Read the rest
ll a few myths about Java and web development in Java.
1. OMG XML.
I cannot remember the last time I had to dive into XML.
2. I can hit refresh and instantly see changes, can you do that in Java?
Yes, every modern web framework has hot-reload, you don't wait, you just save and hit the browser reload button.
It almost feels like a scripting language.
3. How about ORM's and DB access in general ?
We got the mother of all ORM's, hibernate but if don't like ORM's there are great alternatives.
Jooq[0], which feels almost like SQL:
create.selectFrom(BOOK)
.where(BOOK.PUBLISHED_IN.eq(2011))
.orderBy(BOOK.TITLE)
There is also Spring data JPA ( sits on top of hibernate ), which pushes the abstraction to the limit.
Imagine we got a User class with properties name, age, gender.
You could just create a method like this:
User findByNameAndAge(String name, Integer age);
That's it, spring JPA[1] would automatically understand what you meant by that, it would create the query for you.
The Spring framework in general has probably everything you would ever need in a project, no matter how small or big it is.
If for some weird reason, I'd need a lib that tries to communicate with aliens, I'd probably look for it in the Spring framework because someone probably already wrote that lib.
Security out of the box, you can configure it like you please.
I must admit that it's not as awesome as Rails Devise[2].
4. But Java sucks !
Well you can use Kotlin if you really hate Java but let me ask you, when was the last time you used Java?
What If I would tell you that the folks who are working on Java are smart fucks who made many impossible things possible.
If you know Java 5, many things have changed.
memberNames.stream().filter((s) -> s.startsWith("A"))
.map(String::toUpperCase)
.forEach(System.out::println);
Java now supports functional programming ( it's not like Scala but hey ... it's alright )
Most likely the next update[3] will bring this:
var user = new User("john");
Real threading, raw power, amazing mature libs, huge eco system, this blows every language or eco system out of the water.
I could talk for hours about how awesome Java is but I'll stop here.
If you are creating a single page application, take a look at Jhipster[4], which combines Angular with Spring boot with many useful generators, it's a out of the box solution with many options.
As a freelancer, I also must say that the pay is much better than let's say PHP, Ruby or Python.
If one of my side projects gets traction, I can hire freelancer in a heartbeat,
Spring has > 40% market share, naturally there are many devs available.
If you can't stand Spring, there are also many other great frameworks like Play!, Dropwizard etc etc ...
[0] https://www.jooq.org
[1] https://spring.io/guides/gs/accessing-data-jpa/
[2] https://github.com/plataformatec/devise
[3] http://openjdk.java.net/jeps/286
[4] http://www.jhipster.tech