We are currently making the codebase for our company. In this project we upload user data like users ID card, drive license, bills for identity confirmation and a lot of other sensitive data.

My question is why we should use a server that only helps with authentication when we already have to deal with the user data?

From my point of view we are just adding a layer of confusion...


I can think of a couple of reasons:

  • You can use a tried-and-trusted authentication solution, completely independent of any other code you write. The authentication server is a prime target for hackers.
  • It keeps user authentication separate from your customer service people who are dealing with user data. Again, it reduces the security risk.

Not the answer you're looking for? Browse other questions tagged or ask your own question.