Authentication

Choosing the sign in providers

OAuth vendors implement one auth contract. AUTH_PROVIDERS is a comma separated list, and its order is the order of the buttons on the sign in page. A provider whose environment is incomplete is never offered, so a visitor cannot press a button that fails.

• google: OpenID Connect. The address is verified by Google before an account is linked.
• github: OAuth. A developer signs in with the GitHub account they already use.
• microsoft: A work and school identity, managed by the organisation.

AUTH_PROVIDERS=google,github

Sessions

A session token is issued on sign in, hashed with SHA-256 and stored with the account. Only the hash is persisted, so a database leak does not hand over live sessions.

Sessions rotate on a fixed interval. The previous record is revoked with a reason, and a short overlap window lets a request that was already in flight finish without failing.

Replay protection

When a revoked token is presented, the whole session lineage is revoked. A stolen token cannot be used after the legitimate owner rotates or signs out.

Passwords

Passwords are hashed with bcrypt. The cost factor is configurable through the environment, and the minimum length and composition rules are enforced on the server and mirrored in the client.

Authorization

Every protected route resolves the account from the session and never from a request body field. A request that carries a different account identifier is rejected before any read or write happens.