Top 6 JavaScript User Authentication Libraries for 2019/20/21
By: Murali Krishna Garimella
Tags: Open Source, Authentication, Top Javascript Libraries, User Authentication, JavaScript

— Keep learning, keep building and keep growing

User Authentication Top 6 javascript Libraries.

1. Passport JS

Passport.js

Passport is not only a 15k stars user-auth library, it is probably the most common way for JS developers to use an external library for user authentication. This library basically provides relatively flexible and modular middleware for Node.js which can be integrated into any Express-based web application. It’s also a community platform which supports various kinds of common authentications such as username and password, Facebook, Twitter, and more.

2. Auth0

Auth0

While this isn’t a library but rather a service, it’s a robust yet quick way to get the job done. Auth0 is a (quite big) start-up company which provides a wide universal authentication & authorization platform for web, mobile and legacy applications. Some say it’s the closest solution to Plataformatec’s Devise for Ruby on Rails, except you can connect any app or API in any language. There are over 100 pre-built integrations, and here’s a quick-start with Node.js.

Before Permit, the only real choice for authentication libraries in Node.js was Passport.js. But it has a bunch of issues that complicate your codebase. A permit makes it easy to add an authentication layer to any Node.js API. It can be used with any of the popular server frameworks (eg. Express, Koa, Hapi, Fastify) and it can be used for any type of API (eg. REST, GraphQL, etc.) due to its simple, unopinionated design.

Permit lets you authenticate via the two schemes most APIs need: a single secret bearer token or a set of username and password credentials. For example, here’s how to authenticate a bearer token:

Differences between Permit and Passport:

Passport is not focused on authenticating APIs. Passport is focused on authenticating web apps with services like Facebook, Twitter and GitHub. APIs don’t need that, so all the extra bloat means lots of complexity for no gain.

Passport is focused on authenticating web apps with services like Facebook, Twitter and GitHub. APIs don’t need that, so all the extra bloat means lots of complexity for no gain. Passport is tightly-coupled to Express. If you use Koa, Hapi, Fastify, or some other framework you have to go to great lengths to get it to play nicely.

If you use Koa, Hapi, Fastify, or some other framework you have to go to great lengths to get it to play nicely. Other middleware is tightly-coupled to it. Passport stores state on the req object, so all your other middleware become tightly coupled to its implementation, making your codebase brittle.

Passport stores state on the req object, so all your other middleware become tightly coupled to its implementation, making your codebase brittle. It results in lots of hard to debug indirection. Because of Passport’s black-box architecture, whenever you need to debug an issue it’s causing you to have to trace its logic across many layers of indirection and many repositories.

Because of Passport’s black-box architecture, whenever you need to debug an issue it’s causing you to have to trace its logic across many layers of indirection and many repositories. It’s not very actively maintained. Passport’s focus on OAuth providers means that it takes on a huge amount of scope, across a lot of repositories, many of which are not actively maintained anymore.

Passport’s focus on OAuth providers means that it takes on a huge amount of scope, across a lot of repositories, many of which are not actively maintained anymore. Differences between Permit and Passport:

Passport is not focused on authenticating APIs. Passport is focused on authenticating web apps with services like Facebook, Twitter and GitHub. APIs don’t need that, so all the extra bloat means lots of complexity for no gain.

Passport is focused on authenticating web apps with services like Facebook, Twitter and GitHub. APIs don’t need that, so all the extra bloat means lots of complexity for no gain. Passport is tightly-coupled to Express. If you use Koa, Hapi, Fastify, or some other framework you have to go to great lengths to get it to play nicely.

If you use Koa, Hapi, Fastify, or some other framework you have to go to great lengths to get it to play nicely. Other middleware is tightly-coupled to it. Passport stores state on the req object, so all your other middleware become tightly coupled to its implementation, making your codebase brittle.

Passport stores state on the req object, so all your other middleware become tightly coupled to its implementation, making your codebase brittle. It results in lots of hard to debug indirection. Because of Passport’s black-box architecture, whenever you need to debug an issue it’s causing you to have to trace its logic across many layers of indirection and many repositories.

Because of Passport’s black-box architecture, whenever you need to debug an issue it’s causing you to have to trace its logic across many layers of indirection and many repositories. It’s not very actively maintained. Passport’s focus on OAuth providers means that it takes on a huge amount of scope, across a lot of repositories, many of which are not actively maintained anymore.

“No way I’m implementing this myself” — Ulysses S. Grant

A rather new and promising library providing OAuth Middleware for Express, Koa and Hapi- with over 180 supported providers and a live playground. In case you want to use it with your own private OAuth provider, you can specify the required key yourself. Although this library is already getting traction (+ 1K stars), resources are relatively scarce so try it out with care.

5. Feathers authentication management

Feathers is an open-source (11K stars) real-time, a micro-service web framework for NodeJS that gives you control over your data via RESTful resources, sockets and flexible plug-ins.

Feathers also provide authentication and authentication management modules which let you add sign up verification, forgotten password reset, and other capabilities to local feathers-authentication. The idea is to combine different authentication methods under one roof, in a flexible infrastructure. Here’s a step-by-step guide to help you get started.

6. Just use Firebase Authentication (for small apps)

This might not necessarily be the long-term solution to managing user auth in your scaling platform (or is it?). But, it’s a very useful way to get the job done, fast and simple, for your applications deployed with Firebase.

Firebase Authentication provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app. It supports authentication using passwords, phone numbers, popular federated identity providers like Google, Facebook, and Twitter. Learn more here.