AU
v1.2.4@gablura/auth-next
Production-ready Next.js authentication with NextAuth.js. Drop-in auth with credentials, Google OAuth, 2FA, email verification, and password reset.
View →
Documentation
Overview
@gablura/auth-core is a framework-agnostic authentication and authorization library for Node.js/Express backends. It implements a dual-token RS256 JWT architecture with short-lived access tokens (15m) and long-lived refresh tokens (7d), backed by Redis for session tracking, token revocation, and distributed locking. The library provides a high-level AuthService for common operations and low-level advanced APIs for custom integrations.
Why it exists
Most teams rebuild authentication from scratch — JWT signing, session tracking, token rotation, 2FA, lockout logic. Each implementation has subtle security bugs. Auth-core exists so you don't have to build this yourself. It encodes years of production patterns: RS256 over HMAC for token signing, Lua scripts for atomic token rotation, device fingerprinting for session binding, and timing-safe comparisons everywhere. The goal is to provide auth primitives that are correct by default and composable when you need customization.
Features
Dual-token RS256 JWT architecture (access + refresh)
Session binding with device fingerprinting and IP validation
Atomic token rotation via Redis Lua scripts
TOTP-based two-factor authentication (via otplib)
Account lockout with configurable thresholds and windows
Distributed refresh locking (prevents token race conditions)
Audit logging with severity levels
Express middleware factory (authenticate, authorize, CSRF, rate limit)
Session timeout management (inactivity + absolute)
Token revocation (access, refresh, session-level)
Timing-safe comparisons throughout
Server-to-server request detection
Private IP detection and CIDR-aware trusted proxy support
Zod validation schemas for all inputs
Zero runtime dependencies beyond Express, Redis, and JSON web tokens
Version
v1.2.4
License
MIT
Status
published