How I Built Authentication in Go and React: Doing It Right
Every tech blog will tell you the same thing: don’t roll your own auth. It makes sense not to do that for production applications with a large number of users, where more is at stake, and to use something like Auth0, Clerk, or Better Auth . Since I had no such requirements, I thought of building one myself from scratch by following best practices. I decided to build this auth system with React,…
Every tech blog advises against building custom authentication systems. While that advice holds for production applications with many users and critical data, smaller projects can benefit from a DIY approach. The author decided to create their authentication system using React, Go, and PostgreSQL to learn more about the process and implement it from scratch.
The primary questions they had to answer were whether to verify each request by checking the database or maintain strict control over the user's session and termination capabilities.
The author opted for JWTs (JSON Web Tokens) due to their stateless nature, meaning they didn't need to maintain strict session control. JWTs are signed JSON objects that contain information like email, user ID, and token expiry. A server can verify the JWT without querying the database, reducing load. However, an expiry is essential to limit the token's validity, usually set around 15 minutes. To maintain control over the refresh token, the server issues and stores it in the database.
The author used PostgreSQL as their database and split the authentication data from the user's public data for better organization. The schema included tables for users, passwords, refresh tokens, and regular users. They preferred storing the refresh token in an HttpOnly, Secure cookie to prevent XSS and MITM attacks. The JWT was stored in client-side JavaScript memory, as it would be destroyed upon page reload and was short-lived.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
