Comment by jtms

I would never suggest "roll your own", but every web framework I have ever used generally has a library that is the go to battle tested auth implementation and just requires adding a few columns and/or tables to your database.