volatiletech/authboss

Features

• User Account Management - Manages the full lifecycle of user profiles, from registration and email verification to password resets.
• Server-Side Session Storages - Stores and retrieves user identity state across requests using server-side storage and secure cookies.
• Account Brute-Force Protection - Implements brute-force protection by tracking failed attempts and locking accounts in the database.
• Account Recovery - Provides a secure flow for users to reset forgotten passwords via email verification tokens.
• Email Verification Flows - Generates secure, short-lived hashes sent via email to verify account ownership during registration and resets.
• OAuth and Identity Providers - Delegates user authentication to external identity services using OAuth1 and OAuth2 protocols.
• Email Verifications - Prevents login attempts until users confirm their email addresses to prove account ownership.
• Identity Authentication - Provides a modular framework for configuring session-based authentication and identity management tailored to project needs.
• User Identity Verification - Verifies user identities through external providers using standard token-based authentication protocols.
• Account Registrations - Handles the full account creation process, including the setup of user identities and optional email verification.
• OAuth1 Implementations - Verifies user identities through external providers using the OAuth1 token protocol.
• OAuth2 Implementations - Verifies user identities through external providers using the OAuth2 token protocol.
• Multi-Factor Authentication - Provides a complete multi-factor authentication suite including SMS and TOTP verification.
• OAuth Provider Integrations - Provides seamless integration with external identity providers like Google and GitHub via OAuth protocols.
• OAuth Flow Implementations - Implements a standardized sequence of redirects and callback handlers for external identity provider authentication.
• OAuth2 Integration - Implements secure user authorization and single sign-on via OAuth2 provider integration.
• One-Time Passwords - Provides a second security layer by validating time-based numeric codes against a shared secret.
• Middleware Route Filters - Uses request middleware to verify session states and block unauthenticated users from protected routes.
• Session-Cookie Persistences - Uses persistent cookies and tokens to maintain authenticated sessions across different browser restarts.
• Session Lifecycle Management - Manages the full session lifecycle, including persistent cookies and inactivity timeouts.
• Inactivity Session Termination - Automatically terminates user sessions after a configured period of inactivity by monitoring activity timestamps.
• User Session Termination - Implements mechanisms to explicitly destroy active user sessions for both standard and OAuth2 authentication flows.
• Session Persistence - Maintains user identity across requests using unique identifiers stored in cookies and server-side storage.
• Two-Factor Authentication - Adds a second security layer using time-based passwords, SMS codes, or recovery codes.
• TOTP Enforcers - Enforces a second security layer during login using TOTP authenticator apps or SMS verification.
• Brute Force Protection - Locks user accounts after repeated failed authentication attempts to stop brute-force attacks.
• Password Resets - Provides a secure password recovery flow driven by email-based verification tokens.
• Credential Authentications - Verifies user identities by checking provided passwords against stored records to grant session access.
• User Registrations - Create new user accounts while preserving input data during validation failures.
• Session Expiration Policies - Invalidates active login sessions after a set period to force user re-authentication.
• Authentication Frameworks - Provides a modular PHP-based framework for handling user registration, password resets, and session management.
• Account Locking - Block account access after repeated failed authentication attempts to prevent unauthorized entry.
• Adaptive Hashing Costs - Automatically updates password hashes during login to increase computational complexity as hardware improves.
• Logic Customizers - Offers programmable extensions to customize authentication routing, error handling, and response rendering.
• Route-Based Access Restrictions - Provides request middleware to block unauthenticated or locked users from accessing specific routes.
• Session State Persistence - Maintains authenticated user identities across browser restarts using secure long-term tokens.
• Remember-Me Persistence - Uses persistent cookies to maintain authentication across different browser sessions.
• Backup Code Management - Generates and validates one-time backup recovery codes for account access when second-factor methods are unavailable.
• Account Security Policies - Enforces security policies including account locking and adaptive password hashing.
• Password Changes - Enables updating user passwords while simultaneously adjusting cryptographic hashing costs and invalidating remember-me tokens.
• Authentication and Authorization - Modular web authentication system.
• Security & Privacy - Modular authentication system for web applications.

Star history