Login in 2 Hours. Then a Refresh Lost It

I have not written authentication myself. On client work and my own side projects I have used Firebase Auth and Auth.js. Getting basic login working took 1 to 2 hours, which is the whole argument for not building it. The password reset and email side took about as long again and was the fiddly part. And I hit a bug where a page refresh logged the user straight out.

So this is a report from the buy side only. If you want to know what hand-rolling auth costs, somebody else has to tell you.

Two hours is the argument, and it is a strong one

Email and password sign-in, in an afternoon, on either of these. That is sign-up, sign-in, sign-out, a user record and a session, none of which I wrote.

Set that against what building it means. Password hashing chosen correctly, session tokens that are long enough and random enough, expiry, rotation, a reset flow that cannot be used to enumerate accounts, rate limiting on the login endpoint, and the ongoing job of keeping all of that current. Two hours against that list is not a close decision.

The reset and email side took about as long again, which surprised me. Login is one screen and one call. Reset is a token with a lifetime, an email that has to arrive, a landing page that has to validate the token, and a set of failure cases that all look the same to the user. Nothing about it is hard. There is simply more of it than you expect, and most of it is configuration rather than code. The email arriving at all is its own problem, which I wrote about in why Gmail junks email sent from your app.

The refresh bug, and what the documentation says about it

A page refresh signing the user out looks like a broken library. It is a setting, and Firebase documents it clearly enough that I should have read it first instead of debugging it.

Firebase Auth has three persistence modes for the web. LOCAL keeps the session indefinitely, surviving the browser being closed, until an explicit sign-out. SESSION keeps it in the current tab or window only, and clears when that tab closes. NONE keeps it in memory, and the documentation says the state disappears when the page refreshes. Read on 2 October 2026.

That third description is my symptom, word for word. There is a second route to the same place, though, and it is the one worth knowing: the docs say the default for web is LOCAL, provided browser storage mechanisms such as third-party cookies are enabled. So the default can also produce this if storage is blocked, which happens in private windows and with some privacy settings.

I cannot tell you which of those two caused mine. I did not instrument it, and both fit. What I took from it is more useful than the answer would have been: the same user-visible bug has one cause you control and one you do not, so the fix is to set persistence explicitly rather than to rely on a default that has a condition attached.

What buying actually costs you

The hours I lost went on behaviour I had not configured, rather than on anything I had to write.

When you build a thing, you know where every decision was made, because you made it. When you buy one, the decisions already exist, which is the point, and you find out about them one surprise at a time. A session that vanishes on refresh comes from a default you never read, and from the user's side that looks exactly like a bug you wrote.

So the trade is real and it is still worth taking. You exchange a large amount of security-critical work you would do badly for a smaller amount of configuration you will do incompletely. Just budget for the second half. Login in 2 hours was true for me. Auth finished in 2 hours was not.

What I would check on day one now

Set the persistence mode explicitly, whichever one you want, rather than taking the default. Then test the thing I did not: sign in, refresh the page, and sign in again in a private window. Those three actions would have found my bug in under a minute. Send yourself a real password reset to a real Gmail address as well, and look in the spam folder before you decide it works.