Securing the REST APIs - Security Framework (Technology) V/S Custom

Question

There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far:

1. Using existing token based IAM solutions like Okta, KeyCloak, Auth0, etc.

   • Pros: Already proven solution, feature rich, easy to start and run
   • Cons: Difficult to customize as per needs as the application grows, application becomes dependent on these third party solutions

2. Building custom solution using filters, interceptors, and JWT (or opaque tokens)

   • Pros: Easy to customize as per needs as we have full control
   • Cons: Chances of error/leaks increases, amount of code to write and manage increases

Above are the points as per my understanding of securing the REST APIs, using token based authentication and authorization. I want to know -

1. Which of these (or any other) are widely accepted and used in production environments?
2. Which from these are best suited for small to mid scale projects?
3. Is there any other way/solution (token based or anything else) to secure the REST APIs?

Answer 1

1. I think pretty much all of these are used widely but I would recommend avoiding the more customized solutions. JWTs are widely used, for example but I've seen a few articles about their inherent weaknesses as a security solution.
2. I think this is the wrong way to think about this. When considering security solutions you should consider your threat model instead. Another consideration is: what is the context of the usage? Are these to be accessed by other servers, client applications with human users e.g. browsers?
3. One option that you don't have listed here is mTLS (client-certificates.) Whether this is a good option for you depends on the context as mentioned in 2. They are useful in situations where you have servers calling your API. They provide basically all of the features that a host certificate provides. To support clients that are controlled by people, using a 3rd party token-based solution is generally more appropriate. It's also possible to support both.