Authentication in 2026: Sessions vs JWTs, OAuth Flows, and the Security Tradeoffs Nobody Explains

import { randomBytes } from "crypto";
 
interface SessionData {
  userId: string;
  roles: string[];
  createdAt: number;
  lastActivity: number;
  ipAddress: string;
  userAgent: string;
  csrfToken: string;
}
 
class SessionStore {
  private redis: Redis;
  private readonly SESSION_TTL = 60 * 60 * 24; // 24 hours
  private readonly IDLE_TIMEOUT = 60 * 30; // 30 minutes
 
  async create(userId: string, req: Request): Promise<string> {
    const sessionId = randomBytes(32).toString("hex");
    const csrfToken = randomBytes(32).toString("hex");
 
    const session: SessionData = {
      userId,
      roles: await this.loadUserRoles(userId),
      createdAt: Date.now(),
      lastActivity: Date.now(),
      ipAddress: this.extractIp(req),
      userAgent: req.headers.get("user-agent") ?? "unknown",
      csrfToken,
    };
 
    await this.redis.set(
      `session:${sessionId}`,
      JSON.stringify(session),
      "EX",
      this.SESSION_TTL
    );
 
    // Track active sessions per user for the "active sessions" UI
    await this.redis.sadd(`user-sessions:${userId}`, sessionId);
 
    return sessionId;
  }
 
  async validate(sessionId: string): Promise<SessionData | null> {
    const raw = await this.redis.get(`session:${sessionId}`);
    if (!raw) return null;
 
    const session: SessionData = JSON.parse(raw);
 
    // Check idle timeout
    if (Date.now() - session.lastActivity > this.IDLE_TIMEOUT * 1000) {
      await this.destroy(sessionId, session.userId);
      return null;
    }
 
    // Sliding window: refresh TTL on activity
    session.lastActivity = Date.now();
    await this.redis.set(
      `session:${sessionId}`,
      JSON.stringify(session),
      "EX",
      this.SESSION_TTL
    );
 
    return session;
  }
 
  async destroy(sessionId: string, userId: string): Promise<void> {
    await this.redis.del(`session:${sessionId}`);
    await this.redis.srem(`user-sessions:${userId}`, sessionId);
  }
 
  async destroyAllForUser(userId: string): Promise<void> {
    const sessionIds = await this.redis.smembers(`user-sessions:${userId}`);
    if (sessionIds.length > 0) {
      await this.redis.del(...sessionIds.map((id) => `session:${id}`));
      await this.redis.del(`user-sessions:${userId}`);
    }
  }
}

import { SignJWT, jwtVerify, type JWTPayload } from "jose";
 
interface AuthTokenPayload extends JWTPayload {
  sub: string;
  roles: string[];
  sessionId: string; // Link back to the session for revocation
}
 
const ACCESS_TOKEN_TTL = "5m"; // 5 minutes, not 15, not 1 hour
const SIGNING_KEY = new TextEncoder().encode(process.env.JWT_SECRET);
 
async function createAccessToken(
  userId: string,
  roles: string[],
  sessionId: string
): Promise<string> {
  return new SignJWT({
    sub: userId,
    roles,
    sessionId,
  } satisfies AuthTokenPayload)
    .setProtectedHeader({ alg: "HS256", typ: "JWT" })
    .setIssuedAt()
    .setExpirationTime(ACCESS_TOKEN_TTL)
    .setIssuer("https://yourdomain.com")
    .setAudience("https://yourdomain.com")
    .setJti(crypto.randomUUID())
    .sign(SIGNING_KEY);
}
 
async function verifyAccessToken(
  token: string
): Promise<AuthTokenPayload | null> {
  try {
    const { payload } = await jwtVerify(token, SIGNING_KEY, {
      issuer: "https://yourdomain.com",
      audience: "https://yourdomain.com",
      algorithms: ["HS256"],
      // jose handles exp/nbf/iat validation automatically
    });
 
    return payload as AuthTokenPayload;
  } catch {
    return null;
  }
}

function setAuthCookie(res: Response, name: string, value: string): void {
  const isProduction = process.env.NODE_ENV === "production";
 
  res.headers.append(
    "Set-Cookie",
    [
      `${name}=${value}`,
      "HttpOnly",
      isProduction ? "Secure" : "",
      "SameSite=Lax",
      "Path=/",
      `Max-Age=${60 * 60 * 24}`, // 24 hours
      isProduction ? `Domain=.yourdomain.com` : "",
    ]
      .filter(Boolean)
      .join("; ")
  );
}

// __Host- prefix requires: Secure, no Domain, Path=/
// This prevents subdomain attacks and ensures HTTPS-only
const COOKIE_NAME = "__Host-session";
 
// __Secure- prefix requires: Secure flag
// Less restrictive but still ensures HTTPS
const FALLBACK_COOKIE_NAME = "__Secure-session";

import { createHash, randomBytes } from "crypto";
 
// Step 1: Generate PKCE values and redirect to the authorization server
function initiateOAuthFlow(): {
  authorizationUrl: string;
  state: string;
  codeVerifier: string;
} {
  // PKCE: Generate a random code verifier
  const codeVerifier = randomBytes(32)
    .toString("base64url")
    .slice(0, 128);
 
  // PKCE: Hash the verifier to create the challenge
  const codeChallenge = createHash("sha256")
    .update(codeVerifier)
    .digest("base64url");
 
  // State parameter prevents CSRF attacks on the callback
  const state = randomBytes(32).toString("hex");
 
  const params = new URLSearchParams({
    response_type: "code",
    client_id: process.env.OAUTH_CLIENT_ID!,
    redirect_uri: `${process.env.APP_URL}/api/auth/callback`,
    scope: "openid email profile",
    state,
    code_challenge: codeChallenge,
    code_challenge_method: "S256",
    // Prevent authorization server from silently logging in
    prompt: "consent",
  });
 
  return {
    authorizationUrl: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
    state,
    codeVerifier,
  };
}
 
// Step 2: Handle the callback and exchange the code for tokens
async function handleOAuthCallback(
  code: string,
  codeVerifier: string
): Promise<{
  accessToken: string;
  idToken: string;
  refreshToken: string;
}> {
  const response = await fetch("https://oauth2.googleapis.com/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: `${process.env.APP_URL}/api/auth/callback`,
      client_id: process.env.OAUTH_CLIENT_ID!,
      client_secret: process.env.OAUTH_CLIENT_SECRET!,
      code_verifier: codeVerifier, // PKCE: Server hashes this and compares
    }),
  });
 
  if (!response.ok) {
    const error = await response.json();
    throw new Error(`Token exchange failed: ${error.error_description}`);
  }
 
  return response.json();
}

import { createRemoteJWKSet, jwtVerify } from "jose";
 
// Cache the JWKS (JSON Web Key Set) to avoid fetching it on every request
const googleJwks = createRemoteJWKSet(
  new URL("https://www.googleapis.com/oauth2/v3/certs")
);
 
interface IdTokenClaims {
  iss: string; // Issuer (must be accounts.google.com)
  sub: string; // Subject (stable user identifier)
  aud: string; // Audience (must be your client ID)
  email: string;
  email_verified: boolean;
  name: string;
  picture: string;
  exp: number;
  iat: number;
  nonce?: string; // If you sent a nonce in the auth request
}
 
async function verifyIdToken(idToken: string): Promise<IdTokenClaims> {
  const { payload } = await jwtVerify(idToken, googleJwks, {
    issuer: "https://accounts.google.com",
    audience: process.env.OAUTH_CLIENT_ID!,
  });
 
  const claims = payload as unknown as IdTokenClaims;
 
  // CRITICAL: Check that the email is verified
  // Without this, an attacker can create a Google account with your
  // user's email, not verify it, and log in as them
  if (!claims.email_verified) {
    throw new Error("Email not verified by the identity provider");
  }
 
  return claims;
}

// Step 1: Device requests authorization
async function requestDeviceCode(): Promise<{
  deviceCode: string;
  userCode: string;
  verificationUri: string;
  expiresIn: number;
  interval: number;
}> {
  const response = await fetch(
    "https://oauth2.googleapis.com/device/code",
    {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        client_id: process.env.OAUTH_CLIENT_ID!,
        scope: "openid email profile",
      }),
    }
  );
 
  return response.json();
}
 
// Step 2: Device polls for authorization (user enters code on their phone)
async function pollForDeviceToken(
  deviceCode: string,
  interval: number
): Promise<{ accessToken: string; idToken: string }> {
  while (true) {
    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
 
    const response = await fetch("https://oauth2.googleapis.com/token", {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
        device_code: deviceCode,
        client_id: process.env.OAUTH_CLIENT_ID!,
      }),
    });
 
    const data = await response.json();
 
    if (data.error === "authorization_pending") {
      continue; // User hasn't entered the code yet
    }
 
    if (data.error === "slow_down") {
      interval += 5; // Back off as requested
      continue;
    }
 
    if (data.error) {
      throw new Error(`Device auth failed: ${data.error_description}`);
    }
 
    return { accessToken: data.access_token, idToken: data.id_token };
  }
}

interface TokenFamily {
  familyId: string;
  userId: string;
  currentToken: string;
  usedTokens: Set<string>;
  createdAt: number;
  lastRotatedAt: number;
}
 
class RefreshTokenManager {
  private store: Redis;
 
  async createFamily(userId: string): Promise<string> {
    const familyId = crypto.randomUUID();
    const refreshToken = this.generateToken();
 
    const family: TokenFamily = {
      familyId,
      userId,
      currentToken: refreshToken,
      usedTokens: new Set(),
      createdAt: Date.now(),
      lastRotatedAt: Date.now(),
    };
 
    await this.store.set(
      `token-family:${familyId}`,
      JSON.stringify(family, (_, v) => (v instanceof Set ? [...v] : v)),
      "EX",
      60 * 60 * 24 * 30 // 30 days max lifetime
    );
 
    // Map token -> family for lookup
    await this.store.set(
      `refresh-token:${refreshToken}`,
      familyId,
      "EX",
      60 * 60 * 24 * 30
    );
 
    return refreshToken;
  }
 
  async rotate(
    currentRefreshToken: string
  ): Promise<{ accessToken: string; refreshToken: string } | null> {
    const familyId = await this.store.get(
      `refresh-token:${currentRefreshToken}`
    );
    if (!familyId) return null;
 
    const raw = await this.store.get(`token-family:${familyId}`);
    if (!raw) return null;
 
    const family: TokenFamily = JSON.parse(raw, (_, v) =>
      Array.isArray(v) && _.includes("Token") ? new Set(v) : v
    );
 
    // CRITICAL: Check if this token was already used (replay attack)
    if (family.usedTokens.has(currentRefreshToken)) {
      // This token was already rotated. Someone stole it.
      // Kill the entire token family.
      console.error(
        `Refresh token replay detected for user ${family.userId}, ` +
        `family ${familyId}. Revoking all tokens.`
      );
      await this.revokeFamily(familyId);
      // Alert the user
      await this.notifyUserOfSuspiciousActivity(family.userId);
      return null;
    }
 
    // Check that this is actually the current token
    if (family.currentToken !== currentRefreshToken) {
      // Token is not current and not in usedTokens -- invalid
      return null;
    }
 
    // Rotate: mark current as used, generate new token
    const newRefreshToken = this.generateToken();
    family.usedTokens.add(currentRefreshToken);
    family.currentToken = newRefreshToken;
    family.lastRotatedAt = Date.now();
 
    // Update storage
    await this.store.set(
      `token-family:${familyId}`,
      JSON.stringify(family, (_, v) => (v instanceof Set ? [...v] : v)),
      "EX",
      60 * 60 * 24 * 30
    );
    await this.store.del(`refresh-token:${currentRefreshToken}`);
    await this.store.set(
      `refresh-token:${newRefreshToken}`,
      familyId,
      "EX",
      60 * 60 * 24 * 30
    );
 
    const accessToken = await createAccessToken(
      family.userId,
      await this.loadUserRoles(family.userId),
      familyId
    );
 
    return { accessToken, refreshToken: newRefreshToken };
  }
 
  private generateToken(): string {
    return randomBytes(48).toString("base64url");
  }
 
  private async revokeFamily(familyId: string): Promise<void> {
    const raw = await this.store.get(`token-family:${familyId}`);
    if (!raw) return;
    const family: TokenFamily = JSON.parse(raw);
    await this.store.del(`refresh-token:${family.currentToken}`);
    for (const token of family.usedTokens) {
      await this.store.del(`refresh-token:${token}`);
    }
    await this.store.del(`token-family:${familyId}`);
  }
}

import { randomBytes, timingSafeEqual } from "crypto";
 
// Generate a CSRF token and store it in the session
function generateCsrfToken(session: SessionData): string {
  const token = randomBytes(32).toString("hex");
  session.csrfToken = token;
  return token;
}
 
// Middleware: validate CSRF token on state-changing requests
function csrfProtection(req: Request, session: SessionData): boolean {
  // Only check state-changing methods
  const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
  if (safeMethods.has(req.method)) return true;
 
  const tokenFromHeader = req.headers.get("x-csrf-token");
  const tokenFromBody = (req as any).body?.csrfToken;
  const submittedToken = tokenFromHeader ?? tokenFromBody;
 
  if (!submittedToken || !session.csrfToken) return false;
 
  // Use timing-safe comparison to prevent timing attacks
  const a = Buffer.from(submittedToken);
  const b = Buffer.from(session.csrfToken);
 
  if (a.length !== b.length) return false;
 
  return timingSafeEqual(a, b);
}

// Token storage for SPAs: in-memory with HttpOnly refresh cookie
class AuthClient {
  private accessToken: string | null = null;
  private tokenExpiresAt: number = 0;
 
  async getAccessToken(): Promise<string> {
    // If we have a valid token, use it
    if (this.accessToken && Date.now() < this.tokenExpiresAt - 30_000) {
      return this.accessToken;
    }
 
    // Otherwise, refresh using the HttpOnly cookie
    const response = await fetch("/api/auth/refresh", {
      method: "POST",
      credentials: "include", // Send the HttpOnly refresh cookie
    });
 
    if (!response.ok) {
      // Refresh failed -- user needs to log in again
      this.accessToken = null;
      throw new AuthenticationError("Session expired");
    }
 
    const { accessToken, expiresIn } = await response.json();
    this.accessToken = accessToken;
    this.tokenExpiresAt = Date.now() + expiresIn * 1000;
 
    return accessToken;
  }
 
  logout(): void {
    this.accessToken = null;
    this.tokenExpiresAt = 0;
    // Also hit the logout endpoint to clear the refresh cookie
    fetch("/api/auth/logout", { method: "POST", credentials: "include" });
  }
}

function getCSPHeader(): string {
  const directives = [
    "default-src 'self'",
    "script-src 'self' 'strict-dynamic'", // No inline scripts
    "style-src 'self' 'unsafe-inline'", // CSS is less risky
    "img-src 'self' data: https:",
    "font-src 'self'",
    "connect-src 'self' https://api.yourdomain.com",
    "frame-src 'none'", // No iframes
    "object-src 'none'", // No plugins
    "base-uri 'self'", // Prevent base tag hijacking
    "form-action 'self'", // Forms can only submit to same origin
    "frame-ancestors 'none'", // Prevent clickjacking
    "upgrade-insecure-requests",
  ];
 
  return directives.join("; ");
}

class MagicLinkAuth {
  private store: Redis;
  private readonly TOKEN_TTL = 60 * 10; // 10 minutes
  private readonly MAX_ATTEMPTS = 3;
 
  async sendMagicLink(email: string): Promise<void> {
    // Rate limit: max 3 magic links per email per hour
    const rateLimitKey = `magic-link-rate:${email}`;
    const attempts = await this.store.incr(rateLimitKey);
    if (attempts === 1) {
      await this.store.expire(rateLimitKey, 3600);
    }
    if (attempts > this.MAX_ATTEMPTS) {
      // Return success to prevent email enumeration
      // but do not actually send
      return;
    }
 
    const token = randomBytes(32).toString("base64url");
 
    await this.store.set(
      `magic-link:${token}`,
      JSON.stringify({
        email,
        createdAt: Date.now(),
        used: false,
      }),
      "EX",
      this.TOKEN_TTL
    );
 
    const magicLink =
      `${process.env.APP_URL}/api/auth/magic-link/verify?token=${token}`;
 
    await this.sendEmail(email, {
      subject: "Sign in to YourApp",
      html: `
        <p>Click the link below to sign in. This link expires in 10 minutes.</p>
        <a href="${magicLink}">Sign in to YourApp</a>
        <p>If you didn't request this, you can safely ignore this email.</p>
      `,
    });
  }
 
  async verifyMagicLink(token: string): Promise<string | null> {
    const raw = await this.store.get(`magic-link:${token}`);
    if (!raw) return null;
 
    const data = JSON.parse(raw);
 
    // One-time use: prevent replay
    if (data.used) return null;
 
    // Mark as used BEFORE creating the session
    // This prevents race conditions where two requests use the same token
    data.used = true;
    await this.store.set(
      `magic-link:${token}`,
      JSON.stringify(data),
      "EX",
      60 // Keep for 1 minute for debugging, then auto-delete
    );
 
    return data.email;
  }
}

import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
  type VerifiedRegistrationResponse,
} from "@simplewebauthn/server";
 
const rpName = "YourApp";
const rpID = "yourdomain.com";
const origin = `https://${rpID}`;
 
// Registration: create a new passkey
async function startPasskeyRegistration(
  userId: string,
  userName: string,
  existingCredentials: Array<{ id: string; transports?: string[] }>
) {
  const options = await generateRegistrationOptions({
    rpName,
    rpID,
    userID: userId,
    userName,
    attestationType: "none", // We don't need attestation for most apps
    excludeCredentials: existingCredentials.map((cred) => ({
      id: cred.id,
      type: "public-key",
      transports: cred.transports as AuthenticatorTransport[],
    })),
    authenticatorSelection: {
      residentKey: "preferred",
      userVerification: "preferred",
    },
  });
 
  // Store the challenge for verification
  await redis.set(
    `webauthn-challenge:${userId}`,
    options.challenge,
    "EX",
    300
  );
 
  return options;
}
 
// Authentication: verify a passkey
async function startPasskeyAuthentication(userId?: string) {
  const options = await generateAuthenticationOptions({
    rpID,
    allowCredentials: userId
      ? await getCredentialsForUser(userId)
      : [], // Empty = discoverable credential (passkey)
    userVerification: "preferred",
  });
 
  const challengeKey = userId
    ? `webauthn-challenge:${userId}`
    : `webauthn-challenge:${options.challenge}`; // For discoverable credentials
 
  await redis.set(challengeKey, options.challenge, "EX", 300);
 
  return options;
}

import { createHmac } from "crypto";
 
function generateTOTP(secret: Buffer, timeStep: number = 30): string {
  const time = Math.floor(Date.now() / 1000 / timeStep);
  const timeBuffer = Buffer.alloc(8);
  timeBuffer.writeBigInt64BE(BigInt(time));
 
  const hmac = createHmac("sha1", secret).update(timeBuffer).digest();
 
  // Dynamic truncation
  const offset = hmac[hmac.length - 1] & 0x0f;
  const code =
    ((hmac[offset] & 0x7f) << 24) |
    ((hmac[offset + 1] & 0xff) << 16) |
    ((hmac[offset + 2] & 0xff) << 8) |
    (hmac[offset + 3] & 0xff);
 
  return (code % 1_000_000).toString().padStart(6, "0");
}
 
function verifyTOTP(
  secret: Buffer,
  submittedCode: string,
  window: number = 1 // Allow 1 step before/after for clock drift
): boolean {
  for (let i = -window; i <= window; i++) {
    const time = Math.floor(Date.now() / 1000 / 30) + i;
    const timeBuffer = Buffer.alloc(8);
    timeBuffer.writeBigInt64BE(BigInt(time));
 
    const hmac = createHmac("sha1", secret).update(timeBuffer).digest();
    const offset = hmac[hmac.length - 1] & 0x0f;
    const code =
      ((hmac[offset] & 0x7f) << 24) |
      ((hmac[offset + 1] & 0xff) << 16) |
      ((hmac[offset + 2] & 0xff) << 8) |
      (hmac[offset + 3] & 0xff);
 
    const expected = (code % 1_000_000).toString().padStart(6, "0");
 
    // Timing-safe comparison
    if (
      submittedCode.length === expected.length &&
      timingSafeEqual(Buffer.from(submittedCode), Buffer.from(expected))
    ) {
      return true;
    }
  }
 
  return false;
}

function generateRecoveryCodes(count: number = 10): string[] {
  return Array.from({ length: count }, () => {
    // Format: XXXX-XXXX-XXXX (12 alphanumeric characters)
    const bytes = randomBytes(9);
    const code = bytes.toString("base64url").slice(0, 12).toUpperCase();
    return `${code.slice(0, 4)}-${code.slice(4, 8)}-${code.slice(8, 12)}`;
  });
}
 
// Store hashed recovery codes (never store them in plaintext)
async function storeRecoveryCodes(
  userId: string,
  codes: string[]
): Promise<void> {
  const hashedCodes = await Promise.all(
    codes.map(async (code) => {
      const salt = randomBytes(16).toString("hex");
      const hash = createHash("sha256")
        .update(salt + code.replace(/-/g, ""))
        .digest("hex");
      return { salt, hash, used: false };
    })
  );
 
  await db.user.update({
    where: { id: userId },
    data: { recoveryCodes: JSON.stringify(hashedCodes) },
  });
}

import { Redis, Cluster } from "ioredis";
 
function createSessionStore(): Redis | Cluster {
  if (process.env.REDIS_CLUSTER_NODES) {
    const nodes = process.env.REDIS_CLUSTER_NODES.split(",").map((node) => {
      const [host, port] = node.split(":");
      return { host, port: parseInt(port, 10) };
    });
 
    return new Cluster(nodes, {
      redisOptions: {
        password: process.env.REDIS_PASSWORD,
        tls: process.env.NODE_ENV === "production" ? {} : undefined,
      },
      // Use hash tags to ensure session data stays on the same shard
      keyPrefix: "{session}:",
    });
  }
 
  return new Redis({
    host: process.env.REDIS_HOST ?? "127.0.0.1",
    port: parseInt(process.env.REDIS_PORT ?? "6379", 10),
    password: process.env.REDIS_PASSWORD,
    // Connection pool settings for high throughput
    maxRetriesPerRequest: 3,
    retryStrategy: (times) => Math.min(times * 50, 2000),
  });
}

async function handleLogin(
  req: Request,
  credentials: { email: string; password: string }
): Promise<Response> {
  const user = await verifyCredentials(credentials);
  if (!user) {
    return new Response("Invalid credentials", { status: 401 });
  }
 
  // CRITICAL: Destroy the old session and create a new one
  // This prevents session fixation
  const oldSessionId = getSessionIdFromCookie(req);
  if (oldSessionId) {
    await sessionStore.destroy(oldSessionId, user.id);
  }
 
  const newSessionId = await sessionStore.create(user.id, req);
  const response = new Response(JSON.stringify({ success: true }), {
    status: 200,
  });
 
  setAuthCookie(response, "__Host-session", newSessionId);
 
  return response;
}

async function enforceSessionLimit(
  userId: string,
  maxSessions: number = 5
): Promise<void> {
  const sessionIds = await redis.smembers(`user-sessions:${userId}`);
 
  if (sessionIds.length >= maxSessions) {
    // Get all sessions with their creation times
    const sessions = await Promise.all(
      sessionIds.map(async (id) => {
        const raw = await redis.get(`session:${id}`);
        return raw ? { id, data: JSON.parse(raw) as SessionData } : null;
      })
    );
 
    const validSessions = sessions
      .filter(Boolean)
      .sort((a, b) => a!.data.createdAt - b!.data.createdAt);
 
    // Remove oldest sessions until we're under the limit
    const toRemove = validSessions.slice(
      0,
      validSessions.length - maxSessions + 1
    );
 
    for (const session of toRemove) {
      if (session) {
        await redis.del(`session:${session.id}`);
        await redis.srem(`user-sessions:${userId}`, session.id);
      }
    }
  }
}

// BAD: Token in URL query parameter
// https://app.com/reset-password?token=abc123
// If this page loads Google Analytics, the Referer header sends the full URL to Google
 
// GOOD: Use the token to verify, then redirect to a clean URL
async function handleResetLink(req: Request): Promise<Response> {
  const url = new URL(req.url);
  const token = url.searchParams.get("token");
 
  if (!token || !(await verifyResetToken(token))) {
    return new Response("Invalid or expired link", { status: 400 });
  }
 
  // Create a short-lived session for the password reset
  const resetSessionId = await createResetSession(token);
 
  // Redirect to a clean URL without the token
  const response = Response.redirect(
    `${process.env.APP_URL}/reset-password`,
    302
  );
  setAuthCookie(response, "__Host-reset-session", resetSessionId);
 
  return response;
}

// In your middleware or server config
headers.set("Referrer-Policy", "strict-origin-when-cross-origin");

// BAD: vulnerable to timing attacks
if (submittedToken === storedToken) { ... }
 
// GOOD: constant-time comparison
import { timingSafeEqual } from "crypto";
 
function safeCompare(a: string, b: string): boolean {
  if (a.length !== b.length) return false;
  return timingSafeEqual(Buffer.from(a), Buffer.from(b));
}

async function createRememberMeToken(userId: string): Promise<string> {
  const selector = randomBytes(12).toString("hex");
  const validator = randomBytes(32).toString("hex");
  const validatorHash = createHash("sha256")
    .update(validator)
    .digest("hex");
 
  await db.rememberMeToken.create({
    data: {
      selector,
      validatorHash,
      userId,
      expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000), // 30 days
    },
  });
 
  // The cookie contains selector:validator
  // Selector is used for lookup, validator is used for verification
  // This way, a database leak reveals only hashes, not valid tokens
  return `${selector}:${validator}`;
}
 
async function verifyRememberMe(token: string): Promise<string | null> {
  const [selector, validator] = token.split(":");
  if (!selector || !validator) return null;
 
  const record = await db.rememberMeToken.findUnique({
    where: { selector },
  });
 
  if (!record || record.expiresAt < new Date()) return null;
 
  const validatorHash = createHash("sha256")
    .update(validator)
    .digest("hex");
 
  if (!safeCompare(validatorHash, record.validatorHash)) return null;
 
  // One-time use: delete and recreate (rotation)
  await db.rememberMeToken.delete({ where: { selector } });
 
  return record.userId;
}

// BAD: MFA verification not bound to login attempt
async function verifyMFA(userId: string, code: string): Promise<boolean> {
  const user = await db.user.findUnique({ where: { id: userId } });
  return verifyTOTP(user.mfaSecret, code);
}
 
// GOOD: MFA verification bound to a specific login attempt
async function verifyMFA(
  loginAttemptId: string,
  code: string
): Promise<boolean> {
  const attempt = await redis.get(`login-attempt:${loginAttemptId}`);
  if (!attempt) return false;
 
  const { userId, mfaRequired, mfaVerified, createdAt } = JSON.parse(attempt);
 
  // Check that the login attempt is recent (5 minutes)
  if (Date.now() - createdAt > 5 * 60 * 1000) return false;
 
  // Check that MFA was actually required for this attempt
  if (!mfaRequired || mfaVerified) return false;
 
  const user = await db.user.findUnique({ where: { id: userId } });
  if (!user || !user.mfaSecret) return false;
 
  const valid = verifyTOTP(Buffer.from(user.mfaSecret, "hex"), code);
 
  if (valid) {
    // Mark this specific attempt as MFA-verified
    await redis.set(
      `login-attempt:${loginAttemptId}`,
      JSON.stringify({ ...JSON.parse(attempt), mfaVerified: true }),
      "EX",
      300
    );
  }
 
  return valid;
}

async function handleLogout(req: Request): Promise<Response> {
  const sessionId = getSessionIdFromCookie(req);
 
  if (sessionId) {
    const session = await sessionStore.get(sessionId);
    if (session) {
      // Destroy the session
      await sessionStore.destroy(sessionId, session.userId);
 
      // Revoke any refresh tokens associated with this session
      await refreshTokenManager.revokeBySession(sessionId);
    }
  }
 
  const response = new Response(JSON.stringify({ success: true }), {
    status: 200,
  });
 
  // Clear all auth cookies
  response.headers.append(
    "Set-Cookie",
    "__Host-session=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
  );
  response.headers.append(
    "Set-Cookie",
    "__Host-refresh=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
  );
 
  // Clear any client-side state
  response.headers.set("Clear-Site-Data", '"cookies", "storage"');
 
  return response;
}

interface RateLimitEntry {
  count: number;
  resetAt: number;
}
 
class AuthRateLimiter {
  private store: Redis;
 
  // Multi-dimensional rate limiting
  async checkLoginAttempt(
    email: string,
    ipAddress: string
  ): Promise<{ allowed: boolean; retryAfter?: number }> {
    const now = Date.now();
 
    // Dimension 1: Per-IP rate limit (broad protection)
    const ipKey = `rate:login:ip:${ipAddress}`;
    const ipLimit = await this.checkLimit(ipKey, {
      maxAttempts: 20, // 20 attempts per IP per window
      windowMs: 15 * 60 * 1000, // 15 minutes
    });
    if (!ipLimit.allowed) return ipLimit;
 
    // Dimension 2: Per-email rate limit (targeted protection)
    const emailKey = `rate:login:email:${email.toLowerCase()}`;
    const emailLimit = await this.checkLimit(emailKey, {
      maxAttempts: 5, // 5 attempts per email per window
      windowMs: 15 * 60 * 1000, // 15 minutes
    });
    if (!emailLimit.allowed) return emailLimit;
 
    // Dimension 3: Global rate limit (DDoS protection)
    const globalKey = `rate:login:global`;
    const globalLimit = await this.checkLimit(globalKey, {
      maxAttempts: 100, // 100 total login attempts per window
      windowMs: 60 * 1000, // 1 minute
    });
    if (!globalLimit.allowed) return globalLimit;
 
    return { allowed: true };
  }
 
  private async checkLimit(
    key: string,
    config: { maxAttempts: number; windowMs: number }
  ): Promise<{ allowed: boolean; retryAfter?: number }> {
    const current = await this.store.incr(key);
    if (current === 1) {
      await this.store.pexpire(key, config.windowMs);
    }
 
    if (current > config.maxAttempts) {
      const ttl = await this.store.pttl(key);
      return {
        allowed: false,
        retryAfter: Math.ceil(ttl / 1000),
      };
    }
 
    return { allowed: true };
  }
 
  // Progressive delays: exponentially increase wait time after failures
  async getProgressiveDelay(email: string): Promise<number> {
    const failKey = `login-fails:${email.toLowerCase()}`;
    const failures = parseInt((await this.store.get(failKey)) ?? "0", 10);
 
    if (failures === 0) return 0;
 
    // 1s, 2s, 4s, 8s, 16s, max 30s
    return Math.min(Math.pow(2, failures - 1) * 1000, 30_000);
  }
 
  async recordFailure(email: string): Promise<void> {
    const failKey = `login-fails:${email.toLowerCase()}`;
    await this.store.incr(failKey);
    await this.store.expire(failKey, 3600); // Reset after 1 hour
  }
 
  async clearFailures(email: string): Promise<void> {
    await this.store.del(`login-fails:${email.toLowerCase()}`);
  }
}