Top all-time · #8580
SuperTokens, Open Source User Authentication
Company blog · supertokens.io/blogsecurityweb
SuperTokens, Open Source User Authentication is the company blog at supertokens.io, writing about security and web. Since 2020, 9 different Hacker News readers have linked it 21 times, most often “How to Set JWTs Properly”. No feed was found, so read it on the site itself.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers link SuperTokens' blog and docs on user authentication, session management, JWTs and rotating refresh tokens. Links are mostly used to support points or to point to documentation.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Open Source User Authentication. Build fast, maintain control, with reasonable pricing.
Most-linked posts?
- How to Set JWTs Properly2 people · 3 mentions · first linked 2020-08-28
- /2 people · 2 mentions · first linked 2021-02-09
- /docs/emailpassword/common-customizations/multi-tenancy/about2 people · 2 mentions · first linked 2020-12-17
What Hacker News says?
I recommend SuperTokens https://supertokens.io/
Comment linking /
on “Okta to Acquire Auth0 for $6.5B”Submitted The reason Okta spent $6.5B on Auth0 as a story · 217 points
HN discussionI've been looking into SuperTokens lately. It's very new, but super promising imo: https://supertokens.io/
Comment linking /
on “Show HN: Clerk – all of user management as-a-service, not just authentication”Submitted How to Set JWTs Properly as a story · 3 points
HN discussionOne important point is that we do not follow the OAuth 2.0 protocol since for simple email password login without SSO, we do not need to provide OAuth. So the login part, is a simple API call with the email / password. On success, a session is created, and the flow for that is provided here (in a diagram): https://supertokens.io/docs/emailpassword/common-customizati...
Comment linking /docs/emailpassword/common-customizations/sessions/about
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Submitted Implementing a forgot password flow (with pseudo code) as a story · 2 points
HN discussionYes, SuperTokens comes with pre made UI. You can choose from one of the three themes we have available and can easily customize the colours / CSS for either of those themes. We also make it possible to easily add your own theme if you like. The docs are here: https://supertokens.io/docs/emailpassword/common-customizati...
Comment linking /docs/emailpassword/common-customizations/styling/changing-colours
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”This is a debatable topic. We wrote a blog post about this as well: https://supertokens.io/blog/are-you-using-jwts-for-user-sess...
Comment linking /blog/are-you-using-jwts-for-user-sessions-in-the-correct-way
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”To an extent, yes: https://supertokens.io/docs/emailpassword/common-customizati... Typical multi tenancy implies that the auth experience and data is isolated per tenant. However, often b2b companies simply want to provide an auth experience to their client within a specific subdomain. They do not mind the auth data be stored in the same db tables as other clients. If this is the use case, then we do support it. If…
Comment linking /docs/emailpassword/common-customizations/multi-tenancy/about
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”They have a feature matrix here: https://supertokens.io/pricing It's at a pretty coarse level of detail, but maybe it will help?
Comment linking /pricing
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”I had the same question - apparently the answer is yes: https://supertokens.io/docs/emailpassword/common-customizati...
Comment linking /docs/emailpassword/common-customizations/multi-tenancy/about
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Yes, we do not recommend storing tokens in localstorage. This is also recommended by other security bodies such as OWASP and NIST. We've written a blog post on this topic as well, that you can read here: https://supertokens.io/blog/cookies-vs-localstorage-for-sess...
Comment linking /blog/cookies-vs-localstorage-for-sessions-everything-you-need-to-know
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”We use httponly cookies too. Yes, we wrote a blog post on cookies vs localstorage too - that you can read here: https://supertokens.io/blog/cookies-vs-localstorage-for-sess...
Comment linking /blog/cookies-vs-localstorage-for-sessions-everything-you-need-to-know
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Thank you for your kind words - its really encouraging! Please do let us know when you are trying it out, we'd be happy to help and hear your feedback. You can join our discord ( https://supertokens.io/discord ) or email me at advait at supertokens [dot] io
Comment linking /discord
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”In this case, you would have to use rotating refresh tokens ( https://tools.ietf.org/html/rfc6819#section-5.2.2.3 ). They are essentially one-time use refresh tokens and help in token theft detection. So essentially, both, the access and the refresh token keep changing. You can learn more about implementation details and its benefits here: https://supertokens.io/blog/the-best-way-to-securely-manage-...
Comment linking /blog/the-best-way-to-securely-manage-user-sessions?s=y
on “JWT is Awesome”One very important aspect of authentication is session management. Doing this wrong (or naively), can have catastrophic effects for your app!! Let me provide an example: It's common knowledge that JWTs are very common. A lot of people who use JWTs, implement them as access tokens for their APIs. JWTs also require a shared secret key - what if this is stolen? Then an attacker can use that to hijack any user's account…
Comment linking /
on “Ask HN: How do you currently solve authentication?”Thanks for your comment. There are a couple of points for this answer: -> Short lived sessions: A lot of the guidelines (OWASP, NIST, industry compliances) recommend having short inactivity timeouts, and "in session", frequent reauths. Those have clear UX problems, but for apps that are OK with those problems, implementing such mechanisms is good enough, security wise! Most existing libraries easily allow you to bui…
Comment linking /pdf/attackshomepagev2
on “Launch HN: SuperTokens (YC S20) – Securely manage session tokens”Technically, you do not need to exactly follow OAuth methodology for sessions. You are right. However, there is one common problem with sessions and OAuth, which is token theft. In order to detect token theft, we use the general principle of changing tokens on each use. So theoretically, we can use one random string token, that changes on each use and solve the problem in case of sessions. The problem with that is t…
Comment linking /blog/the-best-way-to-securely-manage-user-sessions
on “Launch HN: SuperTokens (YC S20) – Securely manage session tokens”Sure! Briefly, we use JWT access tokens which are used for session verification. JWTs can be verified using just a secret key which can be stored in memory. Hence, no network calls = < 1MS latency. However, there are issues with using just a JWT, like inability to revoke them or bottlenecking all user security on one secret key. To solve those and other issues, we use rotating refresh tokens. More about this here: h…
Comment linking /blog/are-you-using-jwts-for-user-sessions-in-the-correct-way
on “Launch HN: SuperTokens (YC S20) – Securely manage session tokens”This problem will also exist if an opaque token is used instead of a JWT (as long as a refresh token is being used). Now you may argue that we don't need to use refresh tokens because that's complex, however, in that case, you are severely compromising on user security. See this please: https://supertokens.io/blog/all-you-need-to-know-about-user-...
Comment linking /blog/all-you-need-to-know-about-user-session-security?s=y
on “JWT Multiple Request Refresh Token”Author here. We forked express-session to use JWT as session tokens and improve security [1, 2], notably: - Prevent session fixation (e.g., when a user logs in a new token is emitted) - Guarantee that destroyed sessions can't be re-saved (e.g., a logged out session can't become alive again) - Reduce the impact of data theft from the store (stores hash(sessId) instead of sessId) We put extra care on tests (well, as a…
Comment linking /blog/express-session-vs-supertokens-for-handling-user-sessions?ref=hackernoon.com
on “Show HN: Express-Session-JWT”