Auth is easy, right ?

The pain point to me is authorization. Doing authorization correctly is really hard.

But most of frameworks i see (open source or closed source) failed at that job.