Engineered with Defense in Depth
MBKAuthe is designed from the ground up to protect user credentials, prevent session hijacking, and safeguard APIs through rigorous cryptography and secure defaults.
Security Safeguards by Default
Every layer of authentication is hardened to withstand common web vulnerabilities.
PBKDF2 Password Hashing
Cryptographically strong password hashing using Node.js crypto PBKDF2 with unique per-user salts.
Session Fixation Prevention
Session identifiers are rotated and encrypted on authentication to thwart session hijacking.
CSRF & Rate Limiting
Built-in double-submit CSRF cookie validation and IP-level rate limiting on sensitive endpoints.
Multi-Session Auto-Pruning
Configurable maximum concurrent sessions per user (MAX_SESSIONS_PER_USER) with automatic eviction of stale logins.
Timing-Safe Comparisons
Constant-time string comparison for secret tokens and API hashes to defeat side-channel attacks.
Strict Cookie Policies
HttpOnly, SameSite=Lax, and Secure cookie flags configured with cross-subdomain sharing support.
Architecture Matrix
| Feature / Component | Implementation Standard | Storage / Engine | Configuration Key |
|---|---|---|---|
| Password Hashing | PBKDF2 with unique per-user salt | Users table (password) | Automatic |
| Two-Factor Authentication | RFC 6238 TOTP (6 digits, 30s step) | TwoFactorAuth & speakeasy | MBKAUTH_TWO_FA_ENABLE |
| Session Encryption | AES-256 encrypted cookies | Sessions table & cookies | SESSION_SECRET_KEY |
| Dual-Database Engines | PostgreSQL (pooled) & SQLite (WAL) | pg.Pool / better-sqlite3 | DB_TYPE, LOGIN_DB, SQLITE_PATH |
| CLI Device Authorization | RFC 8628 Device Flow (single delivery) | PendingToken & ApiTokens | CLI_AUTH_ENABLED |
| Social Sign-in (OAuth) | GitHub App & Google OAuth2 | Passport strategies | GITHUB_LOGIN_ENABLED, GOOGLE_LOGIN_ENABLED |
| Multi-Session Pruning | FIFO automated eviction on limit | Sessions table | MAX_SESSIONS_PER_USER |
Ready to implement in your stack?
Read through the complete step-by-step documentation to set up your database and secure your Express routes.