Authboss

Authboss is a modular HTTP authentication framework for managing user identity, session lifecycles, and password security. It provides a system of identity access middleware to control route access and synchronize user identity across requests via standard web protocols.

The framework is distinguished by a pluggable architecture that allows for the registration of independent modules to extend identity logic. It utilizes a hook-based event system to execute custom business logic during authentication state changes and employs a selector-verifier token pattern to protect against timing attacks during validation.

The system covers comprehensive identity management, including user registration, password hashing, and session state tracking. It supports multi-factor authentication through TOTP and SMS, as well as third-party identity integration using OAuth1 and OAuth2 standards. Additional security capabilities include stateful brute-force protection with account locking and email-based account recovery workflows.

The project supports both server-side HTML template rendering and JSON-based API responses to accommodate headless or traditional web architectures.

Features

Authentication & Authorization Systems - Provides a modular system of authentication and authorization features to control user access.
Password Authentication - Provides a comprehensive system for verifying user credentials against secure password hashes.
User Authentication Systems - Provides a comprehensive framework for verifying user identity, managing registrations, and controlling access to resources.
Authenticated User Retrieval - Loads the authenticated user's state into the request context for use in application business logic.
Identity Data Persistence - Maintains persistent storage of user records, profiles, and session state within a database.
Authentication Event Triggers - Executes custom logic during registration, login, or recovery to modify the authentication request flow.
External Identity Provider Integration - Provides seamless integration with external identity providers for third-party authentication and user sign-in.
HTTP Authentication Frameworks - Offers a modular system for managing user identity, session lifecycles, and password security via standard web protocols.
Identity and Access Management - Provides request-level middleware to manage session state and synchronize user identity across routes.
OAuth and Identity Providers - Authenticates users through third-party identity providers utilizing OAuth1 and OAuth2 standards.
User Profile Management - Provides functionality for storing and retrieving user credentials, usernames, and other account metadata.
Session State Persistence - Synchronizes session state and identity data between the store and the request context via middleware.
Multi-Factor Authentication - Secures accounts using TOTP or SMS-based second factors and provides recovery codes for access.
OAuth Authentication - Integrates OAuth1 and OAuth2 standards to authenticate users via external third-party identity services.
Identity Providers - Uses a standardized interface to integrate third-party identity providers via OAuth1 and OAuth2 standards.
User Record Mapping - Automatically creates or updates user records based on identity details provided by external OAuth2 services.
OAuth2 Providers - Supports OAuth2 authentication by managing provider IDs, access tokens, and refresh tokens for third-party sign-in.
Password Recovery Systems - Provides secure password recovery via tokenized email workflows using selector and verifier patterns.
Session Cookie Tracking - Tracks authentication status and user identity across HTTP requests using key-value session storage.
Route-Level Access Guards - Protects application routes by redirecting unauthenticated users to login while preserving the intended destination.
Password Hashing Utilities - Secures user credentials by generating cryptographic hashes and verifying them during authentication.
Session Lifecycle Management - Manages the complete session lifecycle, including secure logout, expiration tracking, and session whitelisting.
Third-Party Identity Integrations - Integrates third-party identity providers using OAuth1 and OAuth2 standards for simplified user sign-in.
Two-Factor Authentication - Implements secure account verification using TOTP and SMS-based second factors.
User Registrations - Handles new user account creation with input validation and support for preserving form data.
Authentication Event Hooks - Allows custom logic to execute before or after authentication events to modify request flows or trigger side effects.
Modular Feature Architectures - Employs a pluggable architecture where independent modules can be registered to extend identity logic.
Modular Identity Extensions - Employs a pluggable architecture that allows the registration of independent modules to extend identity logic.
User Identity Tracking - Tracks unique primary identifiers and associated profile data to maintain user identity within the application.
Prerequisite Verifications - Prevents unauthorized 2FA activation by enforcing email authorization as a prerequisite for setup.
Account Locking - Automatically disables accounts after a threshold of failed authentication attempts to prevent brute-force attacks.
Account Recovery - Restores account access by tracking recovery selectors and verifiers with expiration timestamps.
Brute Force Protections - Protects accounts from automated password guessing by tracking login attempts and lockout timestamps.
Email Verifications - Ensures email ownership by sending a verification token to the registered user during account setup.
Identity API Endpoints - Provides specialized API endpoints for registration and authentication to support headless architectures.
One-Time Passwords - Provides temporary one-time passwords as a secure alternative to primary user credentials.
Selector-Verifier Tokens - Implements secure two-part tokens with selectors and verifiers to prevent timing attacks during credential validation.
Secure Password Updating - Manages secure password updates including bcrypt cost adjustments and remember-me token invalidation.
Selector-Verifier Token Patterns - Employs a selector-verifier token pattern to protect against timing attacks during validation.
Session-Cookie Persistences - Supports persistent user sessions via cookies to maintain authentication state across browser restarts.
Inactivity Session Termination - Automatically terminates user sessions after a specified duration of inactivity.
Backup Code Management - Manages the generation and validation of one-time use backup codes for 2FA recovery.
Brute Force Protection - Protects accounts from automated password guessing by tracking failed attempts and implementing lockout policies.
Password Resets - Implements a secure password reset workflow using email-based tokens and selector-verifier patterns.
Authentication - Allows the execution of custom functions before or after authentication events to modify behavior or trigger side effects.
User Input Validation - Checks form inputs for errors and groups validation messages by field name for user feedback.
Dynamic View Rendering - Generates authentication interfaces using integrated view engines that support both HTML templates and JSON responses.
JSON APIs - Processes authentication requests and responses using JSON to support headless and API-driven architectures.

volatiletech/authboss

4,189View on GitHub

Authboss is a modular authentication framework designed to manage user identity and account orchestration. It provides a comprehensive system for handling user registration, email verification, and the full lifecycle of user profiles. The framework distinguishes itself through a focused suite of security and identity tools, including multi-factor authentication via time-based passwords and SMS, and identity integration with external providers using OAuth1 and OAuth2 protocols. It also includes a dedicated account security manager that implements brute-force protection through credential-based

teamhanko/hanko

8,801View on GitHub

Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.

laravel/jetstream

4,060View on GitHub

Jetstream is an application scaffold for Laravel that provides a pre-built identity system and team collaboration framework. It serves as a starter kit that integrates user authentication, profile management, and organizational tools into a unified project structure. The project is distinguished by its comprehensive team management capabilities, which include shared workspace organization, member invitation workflows, and role-based access control. It also features an integrated API token manager for issuing and controlling secure access tokens for external clients. The platform covers a bro

steveiliop56/tinyauth

6,979View on GitHub

Tinyauth is an authentication middleware service and identity provider that verifies user identities to grant system access. It operates as a standalone server or as an authentication gateway, utilizing a reverse proxy model to intercept requests and validate credentials before traffic reaches protected backend services. The project functions as an OpenID Connect provider for single sign-on experiences and an OAuth 2.0 gateway that delegates verification to external providers such as Google and GitHub. It also acts as an LDAP authentication server, allowing for centralized user management and

aarondlauthboss

Features