What makes you think they're not safe? Zillions of successful apps have been built using Laravel and Phoenix and (afaik) no-one has hacked their auth code yet. The code is open-source for anyone to inspect for vulnerabilities. I wouldn't feel unsafe using them.

You seem to misunderstand what it means to "roll your own auth".

"Don't roll your own auth" doesn't mean "use a third-party auth provider". It means "use an existing, expert-made auth solution and don't try to write it yourself."

That can be a third-party provider like Firebase, it can be a code dependency like Rails's Devise, it can be generated by `phx.gen.auth` in Phoenix, it doesn't matter - the point is that you're using a tried-and-tested auth solution written by someone who knows what they're doing.

Writing your own auth code is generally a bad idea because it's complicated, time-consuming and easy to get wrong. But there are zillions of off-the-shelf solutions you can use that have been created by security experts and battle-tested in thousands of production apps. As far as I'm concerned, web auth is a solved problem.

Outside of personal projects, third-party auth providers must be audited (think GDPR or PIPL), budget must be allowed, contracts signed, etc. so web developers rarely, if ever, have their say on the matter. The decision is taken long before anyone wrote a single line of code. From a project management perspective, it's an easy trade-off to make: one sprint for integrating Okta versus who knows how many for badly implementing something that requires a level of expertise that no one on the team has reached.

For personal projects, the trade-off is a bit different. Resources are scarce so, even if implementing auth is actually not very complicated(1) and can even be quite fun, there are probably more immediately interesting things to do. So you integrate a third-party solution in a wednesday night and you move on.

[1] https://thecopenhagenbook.com/