Using packages for authentication and authorization

Now that you understand how authentication and authorization work together in a web application, it is time to replace some of the custom code with open-source packages.

There are two good reasons to use open-source packages for authentication in particular. The first reason is that it is easy to make a mistake when writing custom code that creates a security vulnerability. The second reason is that a good authentication package will support a range of different authentication strategies, including authentication with third-party services, such as Google and Facebook.

In Part 3 of this book, I demonstrate a different authentication strategy, but for this chapter, I am going to use open-source packages but still use usernames and passwords for authentication.

Not all features can be replaced with custom code. The focus tends to be on authentication, while authorization is left to individual applications to implement.

...