The hidden cost of your own login box

The list

Password reset, which means transactional email, which means a token with an expiry and a single use. Email verification. Rate limiting, because within a week somebody will try ten thousand passwords. Account lockout, and then the unlock flow, and then the support process for the person locked out at the worst moment.

Then the second factor. Enrolment, recovery codes, the flow when someone loses their phone. Then session management: how long is a session, what happens on a password change, how does someone sign out everywhere.

• Social sign-in, and the account-linking question it creates on day one
• Magic links, because a segment of your users will never remember a password
• Enterprise SSO, which is a different problem wearing the same button
• An audit trail of all of it, because eventually someone will ask

None of it is hard. All of it is long

That is what makes this deceptive. There is no single item on the list you could not build well in an afternoon. There are forty of them, they interact, and the interactions are where the security bugs live — the reset flow that bypasses the second factor, the linked social account that inherits a session it should not.

Meanwhile none of this is your product. Nobody chose you for your password reset email.

There is no item on the list you could not build. There are forty of them, and they interact.

The honest trade

Hosted sign-in costs you a redirect and some theming work. You get the forty items, the ongoing maintenance of them, and the enterprise methods on the same code path from the start — so adding SSO later is a configuration change rather than a second implementation of everything.

If your login box is a differentiator, build it. For almost everyone else it is a tax, and the interesting question is only how much of it you want to pay.