Auth0 vs Purple

Backend-Owned SMS OTP: Cooldowns and Attempt Caps

This technical blog post explains best practices for implementing passwordless phone logins using SMS OTPs in an Express/Node.js backend. It argues that the backend must own resend cooldowns, verification attempt counters, and anti-abuse policies (not the client), model the authentication state machine (ready → code_sent → verified/expired/locked), persist minimal authoritative state, use atomic database transitions, emit single transition events for observability, and use idempotency keys and retry/backoff handling when calling providers. Provider choices (Twilio, Firebase, Auth0, Amazon SNS, Infrai) are discussed with trade-offs between managed verification and owning template/state-machine responsibilities.

• The article recommends the Express/Node.js backend should own SMS OTP resend cooldowns, maximum verification attempts, and anti-abuse counters rather than trusting the client.
• Designs should expose explicit states: send-code, verify-code, resend-code, and lockout; persist minimal authoritative state (challenge ID, phone identity, expiry, next-send time, counters, lockout).
• Use atomic database transitions and idempotency keys tied to admitted transitions to prevent race conditions and duplicate sends.

Don't Build Login Pages Again: Centralized Auth

The article argues that repeatedly rebuilding login and user/role management across projects is inefficient and error-prone. It describes a common pattern where teams duplicate authentication code across multiple apps, leading to duplicated bugs and maintenance burdens. Two solutions are compared: (1) create a reusable login/user-management module/library to import into projects, and (2) build a separate centralized application (service) that handles authentication, users, roles, and exposes an API for other projects. The author favors the centralized application approach and cites existing services (Auth0, Firebase Authentication, Clerk) as examples, then introduces Roled — a centralized user and role management platform — with links to its site and quickstart documentation.

• Repeatedly copying login and user-management code across projects causes duplicated bugs and maintenance overhead.
• Two approaches are proposed: a reusable module/library, or a separate centralized application for login and user/role management.
• The article cites third-party services such as Auth0, Firebase Authentication, and Clerk as existing options.

Purple secures Essex County Council and Tyne and Wear Metro contracts, opens new Manchester office

Purple has been selected by Essex County Council to provide connectivity across 170 sites in a seven-year agreement, and by Nexus to provide WiFi across the Tyne and Wear Metro. The company also opened a new office at Annie Kenney Mill in Chadderton, Oldham, as part of its global expansion.