Nuxt Security is a Nuxt 3+ module that automatically configures applications to follow OWASP security patterns through HTTP headers and middleware. It provides security response headers (including CSP with nonce/hash support for SSR/SSG), request size and rate limiting, XSS validation, CORS support, and optional features like Basic Auth and CSRF protection. The architecture uses Nitro plugins to integrate with Nuxt's server lifecycle, separating concerns between configuration, middleware, build-time plugins, and runtime hooks. The module handles both SSR and SSG modes appropriately, using nonces for CSP in SSR and computed hashes for SSG, with proper strict-dynamic support.
gologin is a well-tested Go library that turns OAuth1 and OAuth2 authorization flows into chainable net/http handlers. In production it lets a web app register LoginHandler and CallbackHandler for providers (GitHub, Google, Facebook, Bitbucket, Twitter, Tumblr) and then read the authenticated user or access token from the request context in the success handler. It also provides a Twitter TokenHandler for native mobile token login. The architecture is a set of primitive handlers (state, login, callback) that communicate via context, with provider packages composing those primitives and adding a user-fetching step; session management stays orthogonal to authentication. The oauth2 subpackage implements RFC 6749 state-parameter CSRF protection with short-lived secure cookies, while the oauth1 subpackage splits request-token acquisition, auth redirect, temporary-secret persistence, and access-token callback so providers with different secret requirements reuse the same pieces. Provider packages are intentionally thin wrappers around the generic handlers and call provider APIs (go-github, go-twitter, sling, google.golang.org/api) to fetch User objects. The code is thoroughly unit-tested with httptest mocks and includes runnable examples for GitHub, Google, and Twitter. Maintenance is active and the dependency manifests are current, though a few provider endpoints lag behind platform APIs (Facebook still targets Graph API v2.9 and Twitter targets v1.1 verify_credentials), so those specific integrations may need updates. The generic OAuth1/OAuth2 machinery remains solid and portable.
pointfreeco/swift-web is a collection of modular Swift libraries for building server-side web applications. It provides a functional approach to routing (ApplicativeRouter using partial isomorphisms and applicative combinators), a type-safe CSS DSL (Css module), an HTTP pipeline middleware system with phantom types for state safety (HttpPipeline), URL form encoding/decoding, HTML rendering integration, and signed cookie support. The architecture is highly modular: each library can be used independently. The codebase demonstrates advanced functional programming patterns from the Point-Free ecosystem, including applicative functors, optics, and monoids. It relies on Apple's SwiftNIO for server I/O and supports both macOS and Linux via Docker. The project is experimental but well-tested with snapshot testing. It is best suited for Swift developers seeking a functional, composable web framework foundation.