In the digital age, crafting an online platform — a bustling marketplace, an engaging social network, or a SaaS product — demands a secure and efficient approach to authentication and authorization. The allure of designing a bespoke solution to manage user identities and access controls is strong, offering a sense of complete control over security standards. Yet, the reality of such undertakings - time-intensive development, resource allocation, and data security and compliance complexities — can significantly detract from core development goals.

Have you ever found yourself knee-deep in code, trying to patch up an authentication system that's become too complex to manage? Picture this: it's late at night, and you're sifting through logs trying to figure out how an unauthorized user accessed your platform. Not only is it frustrating, but it's also risky and diverts your focus from developing the core features of your application. This common situation leads to the question: Is there a better way to securely, efficiently, and cost-effectively handle authentication and authorization?

The wise advice from Ory, "Don't run a user identity and access management solution yourself," echoes the challenges and intricacies involved in secure user management (source). Hence, turning to specialized, developer-friendly security solutions becomes not just an option but a necessity for optimizing development workflows and adhering to top-tier security practices.

Among the plethora of available options, including well-known entities like Auth0, Frontegg, FusionAuth, Keycloak, and SuperTokens, my previous encounter with Auth0 while building a SaaS platform was generally positive, despite challenges related to its integration - mainly due to the SDK v3 lacking methods, type definitions, and consistent error handling and the difficulty to set up a temporary environment for end to end tests. The decision to opt for Auth0 over Ory was mainly driven by the latter's nascent stage and the absence of certifications that Auth0 already complied with.

Since then, Ory Network has matured significantly, boasting compliance with ISO 27001, SOC 2, and GDPR standards.

This series of articles aims to share insights into integrating Ory, an open-source identity platform, within the NestJS framework. From outlining the journey of creating dedicated NestJS libraries that simplify Ory integration to a hands-on guide on embedding Ory into a NestJS application, I'll walk you through the nuances of leveraging Ory to enhance application security and user experience.

Note: Supposing you are interested in Ory and its ecosystem and can't wait for the third article, you can find a complete example of an Nx/NestJS/Angular real-world application that uses Ory for authentication and authorization in this repository.

Intermediate workshop

NestJS Workshop: Building for Production

Mastering NestJS: From Basics to Advanced Application Design

Learn moreArrow forward
NestJS Workshop: Building for Production
NestJS logo

What to Expect:

  1. Introduction to Ory: We start by discovering the core components of Ory, highlighting their capabilities and how they collectively offer a robust solution for application security. This part will answer questions like: What is Ory? How can Ory benefit your application? Where does it stand out?

  2. Creating Libraries for Simplified Ory Integration in NestJS: If you have ever integrated a third-party authentication service into a NestJS application, you know the process can be complex and time-consuming. You create several modules and providers to abstract the API interactions and connect them to your application's architecture. You implement guards to enforce security policies and write tests to ensure everything works as expected (you do write tests, right?). When you start with a new service, there is always a risk of getting it wrong because you are unfamiliar with its intricacies. This article will describe how I tackled this issue: it should help you gain more concrete knowledge about Ory and eventually inspire you to create your libraries for NestJS.

  3. Practical Integration of Ory in a NestJS Application: After laying the foundation, we will enter the practical aspects of integrating Ory within a NestJS application, covering the services configuration with Docker and the backend integration. We will leverage our freshly baked libraries and CLI tools for maximum efficiency. This article will give you a clear idea of the effort required to integrate Ory into your application, and I will share some tips and tricks to make the integration easier.

  4. Deployment to Ory Network: Finally, we will evaluate Ory Network (the cloud offering of Ory) and its benefits. Starting from the application created in the previous article that uses self-hosted Ory, we will see how interoperable Ory Network is with our existing setup and how we can leverage Ory Network to simplify the deployment process and reduce the operational overhead.

By the end of this series, you will have a comprehensive understanding of Ory's ecosystem and how it can benefit your NestJS (but not only) projects to build secure, modern, and compliant web applications.

Stay tuned as we embark on this journey! The next blog in this series will dive deeper, providing practical insights and step-by-step guidance on integrating Ory with your projects.

Full details will be posted soon!

Check out my talk about Authentication and Authorization Strategies with NestJS and Ory!