Rolling his own doesn't mean custom algos. It means he will use the buildin language functions and/or external packages for that functionality while manually piping all of the pieces together.
While you can definitely manually pipe all of the pieces together and have a functioning system, it's significantly easier, and likely more secure, to use the battle-tested auth library of a framework.
One could also use the builtin language functionality and external packages to write custom crypto, and I think we'd both agree that that's a bad idea. I'd argue that it's the same for authentication in general.
I understand that point of view and I agree for the majority of projects but relying on a fully working system that is coupled to some structure can be limiting if you need to make something slightly different.
I see a frameworks like laraval as the middle path where you can rely on the framework to handle auth but also can make any changes you may need.
Comments
Rolling his own doesn't mean custom algos. It means he will use the buildin language functions and/or external packages for that functionality while manually piping all of the pieces together.
He is not asking for trouble..
While you can definitely manually pipe all of the pieces together and have a functioning system, it's significantly easier, and likely more secure, to use the battle-tested auth library of a framework.
One could also use the builtin language functionality and external packages to write custom crypto, and I think we'd both agree that that's a bad idea. I'd argue that it's the same for authentication in general.
I understand that point of view and I agree for the majority of projects but relying on a fully working system that is coupled to some structure can be limiting if you need to make something slightly different.
I see a frameworks like laraval as the middle path where you can rely on the framework to handle auth but also can make any changes you may need.