aarondl/authboss

Features

• Authentication & Authorization Systems - Provides a modular system of authentication and authorization features to control user access.
• Password Authentication - Provides a comprehensive system for verifying user credentials against secure password hashes.
• User Authentication Systems - Provides a comprehensive framework for verifying user identity, managing registrations, and controlling access to resources.
• Authenticated User Retrieval - Loads the authenticated user's state into the request context for use in application business logic.
• Identity Data Persistence - Maintains persistent storage of user records, profiles, and session state within a database.
• Authentication Event Triggers - Executes custom logic during registration, login, or recovery to modify the authentication request flow.
• External Identity Provider Integration - Provides seamless integration with external identity providers for third-party authentication and user sign-in.
• HTTP Authentication Frameworks - Offers a modular system for managing user identity, session lifecycles, and password security via standard web protocols.
• Identity and Access Management - Provides request-level middleware to manage session state and synchronize user identity across routes.
• OAuth and Identity Providers - Authenticates users through third-party identity providers utilizing OAuth1 and OAuth2 standards.
• User Profile Management - Provides functionality for storing and retrieving user credentials, usernames, and other account metadata.
• Session State Persistence - Synchronizes session state and identity data between the store and the request context via middleware.
• Multi-Factor Authentication - Secures accounts using TOTP or SMS-based second factors and provides recovery codes for access.
• OAuth Authentication - Integrates OAuth1 and OAuth2 standards to authenticate users via external third-party identity services.
• Identity Providers - Uses a standardized interface to integrate third-party identity providers via OAuth1 and OAuth2 standards.
• User Record Mapping - Automatically creates or updates user records based on identity details provided by external OAuth2 services.
• OAuth2 Providers - Supports OAuth2 authentication by managing provider IDs, access tokens, and refresh tokens for third-party sign-in.
• Password Recovery Systems - Provides secure password recovery via tokenized email workflows using selector and verifier patterns.
• Session Cookie Tracking - Tracks authentication status and user identity across HTTP requests using key-value session storage.
• Route-Level Access Guards - Protects application routes by redirecting unauthenticated users to login while preserving the intended destination.
• Password Hashing Utilities - Secures user credentials by generating cryptographic hashes and verifying them during authentication.
• Session Lifecycle Management - Manages the complete session lifecycle, including secure logout, expiration tracking, and session whitelisting.
• Third-Party Identity Integrations - Integrates third-party identity providers using OAuth1 and OAuth2 standards for simplified user sign-in.
• Two-Factor Authentication - Implements secure account verification using TOTP and SMS-based second factors.
• User Registrations - Handles new user account creation with input validation and support for preserving form data.
• Authentication Event Hooks - Allows custom logic to execute before or after authentication events to modify request flows or trigger side effects.
• Modular Feature Architectures - Employs a pluggable architecture where independent modules can be registered to extend identity logic.
• Modular Identity Extensions - Employs a pluggable architecture that allows the registration of independent modules to extend identity logic.
• User Identity Tracking - Tracks unique primary identifiers and associated profile data to maintain user identity within the application.
• Prerequisite Verifications - Prevents unauthorized 2FA activation by enforcing email authorization as a prerequisite for setup.
• Account Locking - Automatically disables accounts after a threshold of failed authentication attempts to prevent brute-force attacks.
• Account Recovery - Restores account access by tracking recovery selectors and verifiers with expiration timestamps.
• Brute Force Protections - Protects accounts from automated password guessing by tracking login attempts and lockout timestamps.
• Email Verifications - Ensures email ownership by sending a verification token to the registered user during account setup.
• Identity API Endpoints - Provides specialized API endpoints for registration and authentication to support headless architectures.
• One-Time Passwords - Provides temporary one-time passwords as a secure alternative to primary user credentials.
• Selector-Verifier Tokens - Implements secure two-part tokens with selectors and verifiers to prevent timing attacks during credential validation.
• Secure Password Updating - Manages secure password updates including bcrypt cost adjustments and remember-me token invalidation.
• Selector-Verifier Token Patterns - Employs a selector-verifier token pattern to protect against timing attacks during validation.
• Session-Cookie Persistences - Supports persistent user sessions via cookies to maintain authentication state across browser restarts.
• Inactivity Session Termination - Automatically terminates user sessions after a specified duration of inactivity.
• Backup Code Management - Manages the generation and validation of one-time use backup codes for 2FA recovery.
• Brute Force Protection - Protects accounts from automated password guessing by tracking failed attempts and implementing lockout policies.
• Password Resets - Implements a secure password reset workflow using email-based tokens and selector-verifier patterns.
• Authentication - Allows the execution of custom functions before or after authentication events to modify behavior or trigger side effects.
• User Input Validation - Checks form inputs for errors and groups validation messages by field name for user feedback.
• Dynamic View Rendering - Generates authentication interfaces using integrated view engines that support both HTML templates and JSON responses.
• JSON APIs - Processes authentication requests and responses using JSON to support headless and API-driven architectures.

Star history