State of Servant authentication · haskell-servant/servant#1484

(25 comments) (3 reactions) (1 assignee)Haskell (1,953 stars) (422 forks)batch import

enhancementhelp wantedidea

Description

I took over the maintenance after a lot of help from @alpmestan when I needed to figure out servant-auth. I share the same experience as others of wasting countless hours, but I did put a lot of those hours back so that it's a tiny bit better nowadays.

Here's a short overview of incremental changes with the most impact:

write tutorials for common use cases (this would solve most of newcomers as they can have a working version they can revert to - see https://github.com/haskell-servant/servant-auth/issues/167)

remove XSRF being required for GET requests https://github.com/haskell-servant/servant-auth/issues/192

https://github.com/haskell-servant/servant-auth/issues/129

Commonly requested features:

https://github.com/haskell-servant/servant-auth/issues/140

authorization https://github.com/haskell-servant/servant-auth/issues/119 https://github.com/haskell-servant/servant-auth/issues/73

not requiring JWT for cookie auth https://github.com/haskell-servant/servant-auth/issues/151

Last but not least, the plan is to port servant-auth to servant and deprecate the old auth: https://github.com/haskell-servant/servant/issues/805

These days I'm in brutal prioritization mode of scaling my business, so I can't do much maintenance but I do want to do everything I can for someone else to step up!

Originally posted by @domenkozar in https://github.com/haskell-servant/servant-auth/issues/195#issuecomment-909959489

Contributor guide

Tech stack: None
Domain: backendapisecurity
Issue type: research
Difficulty: 5
Estimated time: over 1 week
Activity status: blocked
Clarity: unclear
Prerequisites: Haskellservant frameworkauthentication
Newbie friendliness: 10
Research direction: Review the linked issues in the servant auth repository (e.g., #167, #192, #129, #140, #119, #73, #151) and the servant issue #805 regarding porting servant auth. Understand the current state of authentication in servant, the planned deprecation of the old auth, and the required features. The conversation in this issue (comment from @domenkozar) provides context on the maintenance bottleneck and desired improvements. Examine the servant auth codebase to assess the feasibility of writing tutorials and removing XSRF requirements for GET requests.