Choosing Between Delegated and Password-based Auth

In this lesson, you will learn how to evaluate the trade-offs between implementing traditional password-based authentication and leveraging delegated identity providers (IdPs) like Google or GitHub.

When to Choose Delegated Auth

Delegated authentication (using OAuth2/OIDC) is generally the gold standard for modern applications. By offloading the authentication process to a trusted third party, you eliminate the massive security burden of storing user credentials. You never have to worry about password hashing, salting, or brute-force attacks on your login endpoints.

Use delegated auth when:

• User Experience is Priority: Users prefer the "one-click" login convenience.
• Security Overhead is High: You want to avoid the risks associated with managing a database of password_hash strings.
• Multi-Device Access: Identity providers handle account recovery and multi-factor authentication (MFA) for you.

When to Stick to Password-Based Auth

Despite the benefits of delegated auth, traditional credentials still have a place. You might choose to implement your own password-based system using bcrypt or argon2 if:

• Compliance and Control: You are building an enterprise or internal tool where you must maintain full control over the identity lifecycle without external dependencies.
• Domain Specificity: Your application serves users who lack social media accounts or are prohibited from using external IdPs due to strict privacy policies.
• Reducing "Fragile" Integrations: Delegated flows can break if an IdP changes their API or deprecates a scope. If your app requires 100% uptime regardless of external service health, a local fallback is beneficial.

The Hybrid Approach

Many developers choose a hybrid approach, allowing both methods. In your Node.js backend, you can normalize these by mapping external identities to a local user profile:

// A conceptual mapping function
async function findOrCreateUser(profile, authMethod) {
  const user = await User.findOne({ email: profile.email });
  if (user) {
    // Link local account to new auth provider if needed
    return user;
  }
  return await User.create({ ...profile, authMethod }); // 'password' or 'oauth'
}

By keeping your local user schema agnostic, you can support both patterns without tightly coupling your business logic to the specific authentication mechanism.

Key Takeaway: Choose delegated authentication to minimize your security footprint and improve UX, but maintain password-based local auth if your compliance requirements or independence from third-party outages are critical.