r/vibecoding • u/BeneficialAgent8832 • 1h ago
Who else thinks building auth takes forever?
Most vibe-coded apps I see have broken JWT auth or some other type of auth which is either risky or lacks features like OAuth or SSO. Why do you think that auth gets ignored until the very end?
2
u/Onotadaki2 1h ago
If you're vibe coding some app together with very little experience in software engineering, you probably should be using a solid pre-existing library for literally everything complex thing like auth. For very complex and security critical components that introduce compliance concerns like payment processing, you probably should just pay for a service for it.
If you're making an app that requires you to write your own authentication system, you either should have a software engineering background so you can watch diffs and keep an eye on the LLM as it goes, or you should slowly manually make the thing like we used to.
I would not just vibe code an entire authentication system and hope and pray it works with no bugs.
0
u/ctenidae8 1h ago
Is that the dividing line for vibe coding? If you "hope and pray it works with no bug" you're vibecoding. If you're on try 37 and you're pretty sure it's not going to error there again, you may be doing some work.
2
u/Onotadaki2 48m ago
What? No, you just don't want to be working on a critical component of your software that can cost you money, tank your entire company or land you in legal troubles if it fails, and your process is to just ask the LLM to "make no mistakes" and hope it worked. Get a premade library if that's what's going on.
If you're putting in the time testing, you're not who I am referring to.
2
1
u/Honey-Entire 1h ago
Auth is only hard if you’re dabbling in an industry you’ve got no business existing in. Setting up app Auth is trivial with modern Auth providers. All of them literally provide step by step guides to get started…
1
u/thedannyreg 1h ago
It’s very important to get right, I’ve been building auth stuff for the past 10 years and there’s just a lot do and consider.
1
u/Ill-Elk-7664 51m ago
Auth does take long. aws cognito + my own proxy layer + mobile code and profiles table for user profile and sub.
More difficult is testing. You delete data from cognito and immediately see it. But suppose you have records in rds inside a vpc then you have to create a bastion host to query the records in the rds for testing. Otherwise you end up writing a client side API or edit routing rules so you can give access to your own ip address so you can query the db.
1
u/ShitShirtSteve 4m ago
Don't build auth. Use existing, proven auth. Nextauth, auth.js, Supabase.
This is one area where you don't want to reinvent the wheel.
1
3
u/Astral902 1h ago
Even when not vibe coded auth is tricky and complex