I’m building a web app and need roles and permissions, what auth stack should I use?

It depends on what you’re optimizing for, but for most web apps I’d recommend this general stack:

Recommended default stack

• Authentication: an identity provider like Auth0, Clerk, Firebase Auth, or Supabase Auth
• Authorization: RBAC in your app, with a path to ABAC/policy-based rules if needed
• Session handling: secure, httpOnly cookies for web apps
• Backend enforcement: all permission checks on the server, never only in the UI

Good choices by app type

1) Fastest to ship

Use:

• Clerk or Auth0
• App-managed roles in your database
• Server-side middleware/guards for permission checks

Best if you want:

• quick setup
• email/password, OAuth, social login
• orgs/teams
• less auth maintenance

2) More control, lower vendor lock-in

Use:

• Auth.js / NextAuth if you’re on Next.js
• Your own database for users/roles/permissions
• Cookie-based sessions or JWTs depending on architecture

Best if you want:

• more customization
• self-hostable/auth logic in your codebase
• lower monthly SaaS cost

3) Backend-first / full-stack app with built-in auth

Use:

• Supabase Auth or Firebase Auth
• DB-backed roles/permissions
• Row-level security if using Postgres/Supabase

Best if you want:

• quick backend + auth in one platform
• real-time features
• less infrastructure work

Roles and permissions model

A practical starting model:

• User
• Admin
• Manager
• Member

Then define permissions like:

• project:create
• project:edit
• project:delete
• billing:view
• billing:manage

Store:

• users
• roles
• permissions
• user_roles
• role_permissions

If you only need simple access control, RBAC is enough. If permissions depend on attributes like “can edit only projects they own,” add ABAC rules.

My practical recommendation

For a typical SaaS web app:

• Clerk or Auth0 for authentication
• Database-backed RBAC for permissions
• Server-side authorization middleware
• httpOnly cookies for session security

If you’re using Next.js, a very common stack is:

• Auth.js/NextAuth or Clerk
• Postgres
• Prisma
• role checks in server actions / API routes / middleware

Avoid

• putting permission logic only in frontend code
• using JWTs as your only source of truth for rapidly changing permissions unless you handle refresh/invalidation carefully
• hardcoding roles deep in UI components

If you tell me these 4 things, I can recommend one stack exactly:

1. Framework: Next.js, React, Laravel, Rails, Django, etc.
2. Need for teams/orgs?
3. Need social login / SSO?
4. Do you want managed auth or self-hosted?

If you want, I can give you a specific stack recommendation for your framework and a database schema for roles/permissions.