lucia-auth/lucia

Features

• Authentication Frameworks - Provides a complete authentication framework for web apps with session management and multiple login methods.
• Server-Side Session Stores - Creates server-side sessions identified by unguessable tokens to persist state across HTTP requests.
• Secure Client-Side Session Storages - Stores session tokens in HttpOnly, Secure, SameSite=Lax cookies for secure client-side persistence.
• Cryptographic Random Number Generators - Generates cryptographically random session tokens with at least 120 bits of entropy.
• Authentication Libraries - Ships as an authentication library providing session management, OAuth, and password-based login.
• Passwordless Authentication - Supports passkey-based sign-in and password reset with two-factor verification.
• OAuth 2.0 Authorization Flows - Implements OAuth 2.0 authorization code flow for GitHub and Google login integration.
• OAuth Provider Integrations - Integrates with GitHub and Google OAuth providers for social login with callback handling.
• Session Cookie Security - Stores session tokens in HttpOnly, Secure, SameSite=Lax cookies for secure client-side storage.
• Passkey Authentication - Supports passwordless sign-in using device-bound cryptographic passkeys for phishing-resistant authentication.
• Password Authentication - Validates user credentials against stored email and password hashes to grant access.
• Session Token Validation - Manages the full lifecycle of server-side sessions including creation, validation, extension, and idle timeout.
• Database-Backed Session Validations - Stores session state in a database and validates tokens via constant-time hash comparison.
• Session Management Frameworks - Provides a session management framework that adapts to framework-specific request and response patterns.
• Social Login Integrations - Integrates social login via GitHub and Google OAuth with callback handling and session creation.
• Token Generation - Generates cryptographically random strings with at least 120 bits of entropy for session identifiers.
• Two-Factor Authentication - Enforces two-factor authentication using time-based one-time passwords from authenticator apps.
• TOTP Enforcers - Enforces TOTP-based two-factor authentication using authenticator apps after primary login.
• Timing-Side-Channel Protections - Implements constant-time token comparison to prevent timing side-channel attacks during session validation.
• Failed Login Trackers - Limits failed login attempts from a single source within a time window to prevent brute-force attacks.
• CSRF Protection - Blocks cross-site request forgery using Origin header checks and anti-CSRF tokens.
• GitHub OAuth Integrations - Redirects users to GitHub's authorization flow and handles the callback to create a session.
• Google OAuth Providers - Redirects users to Google's consent screen and handles the callback to create a session.
• Idle Session Timeouts - Extends session lifespan only during active user interaction, logging out after prolonged inactivity.
• Expiring Tokens - Issues short-lived tokens that expire within minutes for a balance of speed and revocability.
• Recovery Code Generators - Produces one-use recovery codes that bypass 2FA when the primary authenticator app is unavailable.
• Two-Factor-Guarded - Requires two-factor authentication before allowing a password reset.
• Stateless Token Validation - Validates self-contained tokens like JWTs by checking signature and expiration without database queries.
• Active Session Lifespan Extensions - Extends session lifespan during active user interaction, logging out only after prolonged inactivity.

Star history