florianheinemann/passwordless
Passwordless
Passwordless est une bibliothèque d'authentification Node.js qui permet une vérification sécurisée de l'identité de l'utilisateur en utilisant des jetons à usage unique au lieu des mots de passe traditionnels. Elle fonctionne comme un fournisseur d'identité basé sur un middleware, protégeant les routes et les ressources de l'application en validant ces jetons avant d'accorder l'accès.
La bibliothèque se distingue par une architecture hautement découplée qui sépare la génération, la vérification et la livraison des jetons. Les développeurs peuvent implémenter des stratégies de livraison de jetons personnalisées pour envoyer des codes d'authentification via e-mail, SMS ou services vocaux. De plus, le système prend en charge à la fois l'authentification sans état (stateless), qui valide les jetons à chaque requête individuelle, et la gestion de session persistante pour maintenir l'état de l'utilisateur à travers plusieurs interactions.
Le framework inclut une couche de persistance basée sur des adaptateurs qui permet un stockage flexible des jetons d'authentification dans diverses bases de données ou caches mémoire. Il fournit également des points d'intégration pour les frameworks web, permettant la protection de chemins d'application spécifiques et la gestion de flux de connexion complexes en plusieurs étapes.
La bibliothèque inclut une prise en charge intégrée des messages de retour basés sur la session pour communiquer les résultats de l'authentification aux utilisateurs. Elle est conçue pour être installée en tant que plugin modulaire au sein des environnements de serveur web.
Features
- Passwordless Authentication Providers - Provides a passwordless authentication framework that verifies user identity using one-time tokens sent via email or SMS.
- Passwordless Authentication - Builds secure login systems that verify user identity using one-time tokens sent via email or SMS instead of traditional passwords.
- Request Authentication Middleware - Intercepts incoming HTTP requests to validate authentication tokens before allowing access to protected application routes or resources.
- Token-Based Authentication - Provides token-based authentication, verifying user identity via one-time passwords delivered through email or alternative channels to grant secure access.
- Authentication Middlewares - Verifies user identity using one-time tokens sent via email or SMS instead of traditional passwords within a middleware-based architecture.
- Custom Login Flows - Separates token generation and verification steps to support multi-stage login processes and custom user verification workflows.
- Two-Step Login Flows - Enables complex login flows by decoupling token request and submission, supporting secondary verification steps like manual code entry.
- Authentication Plugins - Provides a modular authentication component that integrates with web frameworks to handle secure login flows and stateless request verification.
- API Request Authentication - Enables secure access for web services by validating authentication tokens on every individual request without relying on server-side session storage.
- Stateless Verifications - Supports stateless authentication, verifying user identity on every individual request without requiring server-side session storage.
- Pluggable Token Persistence - Supports an adapter-based persistence layer that allows for flexible storage of authentication tokens in various databases or memory caches.
- Route-Level Access Guards - Protects specific application routes by requiring valid authentication tokens before granting access to users.
- Security and Access Control - Protects specific application paths and resources by requiring valid authentication tokens before granting users access to sensitive data or functionality.
- Web Session Management - Maintains persistent user login states across multiple requests using middleware to ensure a seamless browsing experience for authenticated application users.
- Stateless Token Validation - Verifies user identity by validating cryptographically signed or stored tokens on every request without requiring server-side session persistence.
- Authentication Token Delivery Services - Facilitates the delivery of one-time authentication tokens through external email, SMS, or voice call providers.
- Session Management Middleware - Maintains user login state across multiple HTTP requests by attaching authentication context to the request object during the middleware execution cycle.
- Session State Management - Manages persistent user sessions across requests, ensuring users remain authenticated while browsing the application.
- Web Framework Integrations - Offers adapters to integrate authentication flows with various web server frameworks beyond the default implementation.
