passport

Yeah, I don't know any other options for vanilla JS that support what you want. There are embeddable/self-hostable auth servers (FusionAuth--full disclosure, I work for them, Keycloak, Ory), but it sounds like you don't want to head down that path. > 1. Cookie or JWT based authentication that supports MFA (OTP, email, and SMS), for clients (web/mobile) that are internal. 2. OAuth2/OIDC (again with MFA), for third-party clients, combined with API keys for identifying registered clients. 3. API keys, for secure clients who will be accessing read-only data or functionality via the API > (if not, I'd like to know what the issues are). For #2, if you are setting up OIDC, you typically don't get to control MFA. You're delegating the authentication event to the upstream identity source, so they control if they ask for additional factors of authe

I went down the rabbithole of using next-auth (now authjs) for a recent project. Having used Passport.js [1] for Oauth2 the last time I was doing node.js ~3 years ago, I found this library to have many footguns as comments/answers on SO and Github. Seems like many people are trying to shoehorn their codebase [2] (!!) to make it work with the way the library manages sign-in flow, redirects, cookies, logout, etc. [3] These were solved problems in the MEAN stack era with middlewares, but now that Next.js/react is the trend, people are doing everything they can to make it work - from relaxing security configs, to stashing things in the JWT just so some callback can get an additional piece of data [4]. [1] https://github.com/jaredhanson/passport [2] https://github.com/nextauthjs/next-auth/issues/600#issuecomm... [3] https://stackoverflow.com/q

Can you describe how you can exploit this? It's good for defense in depth, but you have to pwned the user in another way to set the cookie in the first place right? If you're using httpOnly cookies you should be fine? (Not an expert and genuinely want to know because it seems like the node.js ecosystem doesn't consider it a problem worth fixing either: https://github.com/jaredhanson/passport/issues/192 )

I'm working a mobile application using Node.js and react-native. I'm confused as to where to implement the social login. Whether on client side or server side. For client side I can use - react-native-oauth (https://github.com/fullstackreact/react-native-oauth) For server side I can use - passport (https://github.com/jaredhanson/passport) What is the best practice when it comes to implementing social login for a mobile application?

why not? There are lots of existing scaffolding having authorization setting up using passport https://github.com/jaredhanson/passport You don't even need to write code if you use https://github.com/rethinkdb/horizon, firebase, or similar services. For client side, you can reuse previously written code for authorization logic and just write user interface based on requirement. 40 hours are too much for such work