lucia-auth/lucia
Lucia
Lucia is an authentication library that provides session management, OAuth integration, and password-based login for web applications. It creates and validates server-side sessions using cryptographically random tokens stored in HttpOnly, Secure, SameSite=Lax cookies, with constant-time token comparison to prevent timing side-channel attacks.
The library supports authentication through email and password, GitHub OAuth, Google OAuth, and passkey-based sign-in. It enforces two-factor authentication using time-based one-time passwords (TOTP) from authenticator apps, generates recovery codes for account access, and requires 2FA verification before password resets. Session lifecycle management includes idle timeouts that extend only during active user interaction, short-lived tokens for speed and revocability, and throttled database writes to reduce load during session verification.
Additional capabilities include stateless token validation for self-contained tokens like JWTs, CSRF protection through Origin header checks or anti-CSRF tokens, and throttling of failed login attempts. The library adapts session handling to work with framework-specific request and response patterns.
Features
- Authentication Frameworks - Provides a complete authentication framework for web apps with session management and multiple login methods.
- Server-Side Session Stores - Creates server-side sessions identified by unguessable tokens to persist state across HTTP requests.
- Secure Client-Side Session Storages - Stores session tokens in HttpOnly, Secure, SameSite=Lax cookies for secure client-side persistence.
- Cryptographic Random Number Generators - Generates cryptographically random session tokens with at least 120 bits of entropy.
- Authentication Libraries - Ships as an authentication library providing session management, OAuth, and password-based login.
- Passwordless Authentication - Supports passkey-based sign-in and password reset with two-factor verification.
- OAuth 2.0 Authorization Flows - Implements OAuth 2.0 authorization code flow for GitHub and Google login integration.
- OAuth Provider Integrations - Integrates with GitHub and Google OAuth providers for social login with callback handling.
- Session Cookie Security - Stores session tokens in HttpOnly, Secure, SameSite=Lax cookies for secure client-side storage.
- Passkey Authentication - Supports passwordless sign-in using device-bound cryptographic passkeys for phishing-resistant authentication.
- Password Authentication - Validates user credentials against stored email and password hashes to grant access.
- Session Token Validation - Manages the full lifecycle of server-side sessions including creation, validation, extension, and idle timeout.
- Database-Backed Session Validations - Stores session state in a database and validates tokens via constant-time hash comparison.
- Session Management Frameworks - Provides a session management framework that adapts to framework-specific request and response patterns.
- Social Login Integrations - Integrates social login via GitHub and Google OAuth with callback handling and session creation.
- Token Generation - Generates cryptographically random strings with at least 120 bits of entropy for session identifiers.
- Two-Factor Authentication - Enforces two-factor authentication using time-based one-time passwords from authenticator apps.
- TOTP Enforcers - Enforces TOTP-based two-factor authentication using authenticator apps after primary login.
- Timing-Side-Channel Protections - Implements constant-time token comparison to prevent timing side-channel attacks during session validation.
- Failed Login Trackers - Limits failed login attempts from a single source within a time window to prevent brute-force attacks.
- CSRF Protection - Blocks cross-site request forgery using Origin header checks and anti-CSRF tokens.
- GitHub OAuth Integrations - Redirects users to GitHub's authorization flow and handles the callback to create a session.
- Google OAuth Providers - Redirects users to Google's consent screen and handles the callback to create a session.
- Idle Session Timeouts - Extends session lifespan only during active user interaction, logging out after prolonged inactivity.
- Expiring Tokens - Issues short-lived tokens that expire within minutes for a balance of speed and revocability.
- Recovery Code Generators - Produces one-use recovery codes that bypass 2FA when the primary authenticator app is unavailable.
- Two-Factor-Guarded - Requires two-factor authentication before allowing a password reset.
- Stateless Token Validation - Validates self-contained tokens like JWTs by checking signature and expiration without database queries.
- Active Session Lifespan Extensions - Extends session lifespan during active user interaction, logging out only after prolonged inactivity.
