More authentication methods about biff HOT 4 CLOSED

I've recently added google SSO to Findka. I haven't moved any of that code into Biff, but I will at some point. If anyone wants to use google SSO now/soon, I can prioritize that (or at least post some code samples--it wasn't very complicated).

My implementation of google SSO is a little unorthodox. I don't use google's JWT for session management; I just use it once to verify that you control a given email address, and then I authenticate your (cookie-based) session for that address. This made development fast since Biff already manages the sessions for signin-via-email-link. I didn't want to overhaul Biff's logic for checking authentication. Eventually it'd be worth re-evaluating if using (encrypted, stateless) session cookies is a good approach or if we should switch to JWTs.

from biff.

Also it would be better if email link auth included a temporary code the user can enter in, in case you open the email on a different device from the one you're trying to log in with. That can also help users get around those (stupid, despicable) embedded web browsers that mobile apps are so fond of using.

from biff.

New version of Biff is a lot simpler, and I think just doing email link authentication in the starter project makes sense. The authentication code is very easy to change (it's all contained in the template code). If anyone wants passwords/sso they can implement it themselves and blog about it, then we could link to the blog post from the biff docs.

from biff.

Also it would be better if email link auth included a temporary code the user can enter in, in case you open the email on a different device from the one you're trying to log in with. That can also help users get around those (stupid, despicable) embedded web browsers that mobile apps are so fond of using.

this would still be nice. Notion's implementation makes a good reference. But for now I'll leave this closed until someone brings it up.

from biff.