Authentication Implementations

[revmischa]

There are a number of solutions for handling authentication in an app.

My approach is to try to leverage everything from AWS that I can within reason. I have chosen to use AWS Cognito. It integrates well with other AWS services like API gateway routes, or AppSync where you can describe allowed cognito groups at the type/field/query/mutation/subscription level.
You get a nice admin console as well, and support for many authetication use cases like MFA and magic links.

Furthermore you can grant policies and permissions to authenticated users on a per-user basis, for example granting a logged-in user permission to read or write to a particular S3 prefix, invoke lambda functions directly, communicate on AWSIoT MQTT topics, or anything else. More raw serverless power than most can handle!

It is possible to use any third-party OAuth provider with Cognito. I have a construct that creates an OpenID Connect bridge for LinkedIn and GitHub which do not have native OIDC or Cognito support.

For the webapp I am currently trying out next-auth, a project that ties nicely together with Next.js and has goodies like react hooks, SSR (unstable) support, and Next.js middleware support. It supports Cognito but has some small shortcomings, for example it seems to want its own auth secret (which seems wrong to me; we should be just trusting JWTs issued by Cognito and not issueing our own) but there is a workaround.

So let's see how well Next-Auth and Cognito work together, but I believe this is the most "standard" way to do authentication with Next.js and AWS.