Support guidelines
Description
Hi,
Thanks for your continued work on Firefly III, it's been a fantastic tool in my self-hosted stack.
I did search for the feature request but it was about 3 years ago. So I was wondering if your opinions have changed since then.
I’d like to suggest adding optional support for OIDC authentication. While Firefly III is mainly used by single users, there's a growing need for simpler and more secure login methods especially as more users expose their instances to the internet or integrate them into a broader self-hosted ecosystem.
Why the current model is problematic?:
- Password + TOTP is clunky and often skipped, thus weakening security in practice. For example If the instance for some reason becomes popular, phishing TOTPs can still happen.
- Remote headers are fragile and easy to misconfigure. For example, after logging out of both Firefly III and my identity provider (Authentik), I was automatically logged back in for some reason. I couldn't figure out why and thus stuck to password + TOTP.
- These options can give a false sense of security, especially for users who assume their app is protected when exposed publicly.
Solution
Why OIDC is a better alternative:
- OIDC handles authentication, session management, logout, MFA, passkeys and more all securely and cleanly AFAIK.
- It integrates easily with existing IdPs (like Authentik, Keycloak, etc.), making it easy to log in with Google, passkeys, or other providers.
- It improves the experience for both technical users and their families (no extra passwords, no QR codes, no confusion).
Instead of keeping TOTP and remote headers, Firefly III could offer a simpler setup:
- Password — default
- OIDC (via something like
AUTH_METHOD=oidc in env variables)
(I’m not a developer, so I can’t say for sure, but consolidating to just two auth methods seems like it could reduce long-term complexity for you as a maintainer)
This would cover all use cases. from simple, offline setups to fully integrated secure login, while improving usability, security and (probably) reducing long term maintenance.
Additional context
Personal note: Even I was in the camp of Passwords + TOTPs for a long time until Immich forced me to go for OIDC. Even my mom loves how seamless the login experience is (especially means a lot to me because I maintain her passwords). So now I am on a sprint to eliminate password based logins everywhere in my homelab setup (and also online services that support passkeys). Linkwarden, Immich, Portainer, Yamtrack already support it.
My Authentik setup only allows passkey and Google logins thus making everything passwordless. Thus even as a single user in most instances it seems much more secure as well as convenient especially when multiple stacks are being hosted.
Thanks again for all your work. I know this is a significant shift (probably also out of scope), but I hope it’s something that can be considered down the line.
Support guidelines
Description
Hi,
Thanks for your continued work on Firefly III, it's been a fantastic tool in my self-hosted stack.
I did search for the feature request but it was about 3 years ago. So I was wondering if your opinions have changed since then.
I’d like to suggest adding optional support for OIDC authentication. While Firefly III is mainly used by single users, there's a growing need for simpler and more secure login methods especially as more users expose their instances to the internet or integrate them into a broader self-hosted ecosystem.
Why the current model is problematic?:
Solution
Why OIDC is a better alternative:
Instead of keeping TOTP and remote headers, Firefly III could offer a simpler setup:
AUTH_METHOD=oidcin env variables)(I’m not a developer, so I can’t say for sure, but consolidating to just two auth methods seems like it could reduce long-term complexity for you as a maintainer)
This would cover all use cases. from simple, offline setups to fully integrated secure login, while improving usability, security and (probably) reducing long term maintenance.
Additional context
Personal note: Even I was in the camp of Passwords + TOTPs for a long time until Immich forced me to go for OIDC. Even my mom loves how seamless the login experience is (especially means a lot to me because I maintain her passwords). So now I am on a sprint to eliminate password based logins everywhere in my homelab setup (and also online services that support passkeys). Linkwarden, Immich, Portainer, Yamtrack already support it.
My Authentik setup only allows passkey and Google logins thus making everything passwordless. Thus even as a single user in most instances it seems much more secure as well as convenient especially when multiple stacks are being hosted.
Thanks again for all your work. I know this is a significant shift (probably also out of scope), but I hope it’s something that can be considered down the line.