Rodauth is a Ruby authentication framework designed as a Roda plugin, but also usable as middleware or a standalone library. It provides a comprehensive, modular authentication system covering login, logout, account creation, password management, multi-factor authentication (TOTP, WebAuthn, SMS, recovery codes), JWT/JSON API support, session management, and many security features like lockout, password complexity, and audit logging. The architecture is built around a declarative feature DSL where each feature is a self-contained module that can be enabled via `plugin :rodauth` and configured with hundreds of overridable methods. The core library defines a `Rodauth::Auth` class instantiated per request, with metaprogramming for hooks, routes, and value methods. The codebase is exceptionally well-crafted, with a clean separation of concerns, extensive use of inheritance and composition, and a strong emphasis on security (HMAC tokens, timing-safe comparisons, database functions for password hashing). It is actively maintained by the author Jeremy Evans with a long history of releases and security fixes.
This repository is the official FastAPI full-stack template, providing a production-ready starter for full-stack web applications. It consists of a FastAPI backend (Python 3.14, SQLModel ORM, PostgreSQL, Alembic migrations) and a React frontend (TypeScript, Vite, TanStack Router/Query, Tailwind CSS, shadcn/ui). The template ships with complete authentication (JWT, password hashing with Argon2/Bcrypt, password recovery via email), user and item CRUD, role-based access control, and a responsive dashboard UI. Deployment is handled via Docker Compose with Traefik, and the project includes comprehensive CI/CD pipelines for testing (pytest, Playwright) and deployment (FastAPI Cloud or self-hosted). While it is a template, the code is structured for immediate extension and includes many reusable patterns such as generic CRUD utilities, email templates written in React Email, and auto-generated OpenAPI client code for the frontend. The repository is not a data research project; it is a pure application template with no data pipelines, notebooks, or ML components. It is actively maintained, with frequent commits and a strong community following.
This is the official Go implementation of JSON Web Tokens (JWT), currently at v5. It provides a comprehensive library for creating, signing, parsing, and validating JWTs. The core package implements all standard JWT claims (RegisteredClaims and MapClaims), multiple signing algorithms (HMAC-SHA, RSA, RSA-PSS, ECDSA, Ed25519), and a flexible parser with functional options for configuration (e.g., allowed algorithms, leeway, audience/issuer/subject validation). The library also includes a `request` subpackage for extracting tokens from HTTP requests via headers or form/query parameters, and a `cmd/jwt` CLI tool for debugging and batch operations. Architecturally, it follows a clean separation of concerns: signing methods implement a common `SigningMethod` interface, claims implement a getter-based `Claims` interface, and validation is handled by a stand-alone `Validator` struct that can be used independently of parsing. The code is well-tested, uses only the Go standard library (no third-party dependencies), and follows modern Go idioms like functional options and error wrapping (Go 1.20+). It is actively maintained with CI, linting, CodeQL, and spell-check workflows.
This is a Nuxt.js 2 authentication module that provides zero-boilerplate authentication support. It implements various authentication schemes (local, OAuth2, OpenID Connect, refresh tokens) and integrates with popular providers like Auth0, Google, Facebook, and Laravel-based systems. The module handles token storage, automatic refresh, user management, and provides middleware for route protection. It uses a modular architecture with core auth logic, scheme implementations, provider configurations, and utility functions.
This repository is a Java library for JSON Web Token (JWT) handling per RFC 7519. It provides comprehensive functionality for creating, signing, verifying, and decoding JWTs, supporting multiple cryptographic algorithms including HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), EC (ES256/384/512), and EdDSA (Ed25519/Ed448). The library also includes utilities for JSON Web Key (JWK) management, PEM encoding/decoding of keys and certificates, and ASN.1 DER parsing for low-level cryptographic operations. Architecturally, the library follows a modular structure with clear separation of concerns: core JWT operations in the `jwt` package, JWK handling in `jwks`, PEM utilities in `pem`, and DER parsing in `der`. Cryptographic operations are abstracted through `Signer` and `Verifier` interfaces, enabling the Strategy pattern for pluggable algorithm implementations. Object creation uses the Builder pattern for immutable, fluent APIs (e.g., `JWT.addClaim()`, `KeyPair.build()`). JSON processing is centralized via a configured Jackson `Mapper` with custom serializers/deserializers for Java 8+ date-time types. The design minimizes coupling, allowing components like `JWTUtils` or `HMACSigner` to be reused independently. The library is actively maintained, with recent commits (2026-07-15) and ongoing security updates (e.g., patches for CVE-2022-21449). Dependencies are managed via Maven/Savant, relying primarily on Jackson for JSON processing with optional Bouncy Castle for certain algorithms. The codebase demonstrates strong engineering practices: comprehensive unit tests cover all algorithms and edge cases, clear exception hierarchies provide specific error handling, and Java 9+ module system support is included. It serves as a robust, reusable foundation for any Java application requiring secure token-based authentication or authorization.
JSON::JWT is a Ruby library implementing the JSON Web Token (JWT) family of standards, including JWS (JSON Web Signature), JWE (JSON Web Encryption), and JWK (JSON Web Key). It provides comprehensive cryptographic operations for signing, verifying, encrypting, and decrypting tokens using various algorithms (HMAC, RSA, ECDSA, RSA-PSS, and symmetric encryption). The library also includes JWK Set management with remote fetching and caching capabilities. The architecture is modular: JSON::JWT serves as the main entry point, delegating to JSON::JWS for signing/verification and JSON::JWE for encryption/decryption. JSON::JWK handles key representation and conversion between OpenSSL keys and JWK format. The JWK Set Fetcher provides a configurable HTTP client with pluggable caching, suitable for OpenID Connect discovery. The code demonstrates strong security practices, including constant-time comparison for MAC verification, protection against padding oracle attacks in CBC mode, and proper validation of algorithm headers to prevent algorithm confusion attacks. The test suite covers interop with other JWT libraries (Nimbus JOSE, jsrsasign) and RFC examples, ensuring correctness. Key external dependencies include OpenSSL for cryptographic primitives, Faraday for HTTP, and ActiveSupport for hash extensions. The library is actively maintained with support for Ruby 3.2-4.0 and recent security fixes.
This is a monorepo for Auth.js (formerly NextAuth.js), a framework-agnostic authentication library for web applications. The core engine (`@auth/core`) handles OAuth/OIDC, email/passwordless, credentials, and WebAuthn/Passkey authentication flows. It provides a unified API for session management (JWT or database-backed), CSRF protection, and cookie handling. The library is designed to be integrated into multiple frameworks via separate packages: `@auth/nextjs`, `@auth/sveltekit`, `@auth/express`, `@auth/qwik`, and `@auth/solid-start`. Each framework package adapts the core `Auth` function to the framework's request/response model, offering server-side handlers, middleware, and client-side hooks. The repository also includes over 80 built-in OAuth/OIDC provider definitions (e.g., Google, GitHub, Discord, Auth0) and 20+ database adapters (e.g., Prisma, Drizzle, MongoDB, PostgreSQL, DynamoDB) that implement a standard `Adapter` interface for user persistence. The project is now part of Better Auth, and the README recommends new projects use Better Auth unless specific feature gaps exist. The monorepo contains development apps, example applications, and a comprehensive documentation site built with Nextra.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
pREST is a production-grade Go HTTP server that automatically exposes PostgreSQL databases as RESTful and MCP (Model Context Protocol) APIs without requiring hand-written backend code. It provides instant CRUD endpoints for any table, custom SQL template execution with parameterized queries, and a built-in Studio web UI for exploring and managing APIs. The system is architected around a hexagonal pattern with a clean adapter interface supporting multiple databases (PostgreSQL, TimescaleDB), dependency injection for controllers, and a layered middleware stack for authentication (JWT), authorization (table/field-level ACL), caching, and CORS. Security is a primary concern: SQL injection is mitigated through strict identifier validation, template parameter screening, and bound parameter binding, while credential leakage in logs is prevented by a dedicated redaction package. The codebase is well-tested with both unit tests (using sqlmock) and integration tests (against real PostgreSQL in Docker), and includes OpenTelemetry integration for observability. It is not a data research or analytics project; it is a pure application for building low-code database APIs.
angular-oauth2-oidc is an Angular client library for OAuth 2.0 and OpenID Connect authentication in browser SPAs. Its core is OAuthService, a large stateful injectable that loads OIDC discovery documents, drives login via implicit flow, code flow + PKCE, or password flow, stores tokens through a pluggable OAuthStorage (default sessionStorage, with MemoryStorage fallback), validates tokens through pluggable ValidationHandler implementations, runs silent refresh/session checks via hidden iframes, and emits a typed event stream (OAuthEvent hierarchy) for lifecycle notifications. DefaultOAuthInterceptor attaches bearer tokens to outgoing HTTP calls against configured allowed URLs; UrlHelperService extracts tokens from redirect URLs for both hash and query strategies.
This is a monorepo of first-party middleware and service implementations for the Fiber web framework (v3). It provides production-grade authentication (JWT, PASETO, SPNEGO/Kerberos), authorization (Casbin, OPA), observability (OpenTelemetry, Prometheus, New Relic, Sentry, custom monitor/uptime dashboards), real-time communication (WebSocket, Socket.IO v5), Web Application Firewall (Coraza), resilience patterns (circuit breaker, CPU load shedding), structured logging (zap, zerolog), internationalization, hCaptcha verification, Swagger UI/OpenAPI docs, profiling (fgprof), and Testcontainers integration for testing. Each package lives in its own Go module under v3/, following a consistent Config+New() pattern and includes extensive test coverage with benchmarks. The architecture is library-oriented: components are imported by Fiber applications, not run standalone. The codebase demonstrates strong engineering practices: config validation at construction, atomic concurrency patterns, lock-free read paths, and protocol-level optimizations (e.g., zero-copy Socket.IO codec, WebSocket write coalescing). Some packages show signs of technical drift (e.g., paseto uses a deprecated library, socketio has mutable package globals), but overall the repository is actively maintained with weekly releases and automated dependency updates.
This repository is a .NET library for JWT (JSON Web Token) key management that provides automatic generation and rotation of cryptographic keys for JWT signing (JWS) and encryption (JWE). It features a modular architecture with a core library handling key generation/storage, multiple storage providers (in-memory, file system, Entity Framework Core), and framework-specific integrations for ASP.NET Core and IdentityServer4. The library exposes a JWKS endpoint for sharing public keys and integrates with ASP.NET Core authentication systems to validate tokens using the managed keys. Key entry points include the AddJwksManager() service registration method, UseJwksDiscovery() middleware for the JWKS endpoint, and the IJwtService interface for token generation and validation. The primary data flow involves generating cryptographic keys, storing them via pluggable storage providers, retrieving current keys for token operations, and exposing public keys through the JWKS endpoint. The library depends on System.IdentityModel.Tokens.Jwt for JWT handling, Microsoft.AspNetCore.DataProtection for key protection in the default storage implementation, and various Microsoft.Extensions packages for caching, options, and logging.
GoTrue is a self-contained user registration and authentication API written in Go. It provides endpoints for signup, login (via email/password or OAuth2 providers like GitHub, GitLab, Google, Bitbucket, Facebook), token refresh, password recovery, email verification, and user management (CRUD for admin users). The architecture is a monolithic HTTP API using the chi router, backed by a MySQL database (via pop/v5 ORM) and a configurable mailer (SMTP or noop). It supports both single-tenant and multi-tenant deployments, with JWT-based authentication (HS256) and optional SAML SSO. The codebase is well-organized into packages: api for HTTP handlers, models for database entities, conf for configuration, mailer for email sending, and crypto for security utilities. It includes extensive unit tests and integration tests using a MySQL test database.
django-auth-adfs is a Django authentication backend that enables integration with Microsoft ADFS and Azure AD for single sign-on (SSO). It implements OAuth2 and OpenID Connect flows to authenticate users against enterprise identity providers, automatically creating and updating Django users based on identity claims. The package provides Django authentication backends, middleware for enforcing authentication, URL handlers for the OAuth2 flow, and Django REST Framework integration for token-based API authentication. The architecture follows Django best practices with clear separation of concerns between configuration, backend logic, views, and middleware.
GFast is a full-stack, modular admin panel built with GoFrame v2.10 and Vue3. It provides a RESTful API backend for managing users, roles, departments, menus, dictionaries, configuration, logs, and system monitoring. The architecture follows a layered pattern: API definitions (api/v1), controllers (internal/app/*/controller), business logic (internal/app/*/logic), data access objects (dao), and service interfaces. Authentication uses JWT (gfast-token) and authorization uses Casbin with RBAC. Caching is abstracted via gfast-cache supporting memory or Redis. The system includes a code generator, scheduled tasks, and an OpenAPI/Swagger endpoint. External dependencies include MySQL, Redis, Casbin, and ip2region for IP geolocation.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
This is a comprehensive e-commerce backend platform built with Spring Boot 3.5+, JDK 17, and a multi-module Maven architecture. In production, it serves two distinct APIs: `mall-admin` (admin management) and `mall-portal` (customer-facing storefront), plus a dedicated `mall-search` module for Elasticsearch-powered product search. The system handles product cataloging, order lifecycle management, user registration/authentication, coupon and promotion calculations, shopping cart operations, payment integration (Alipay), and content management (home page banners, recommendations). It uses MySQL as the primary database via MyBatis (with generated mappers), Redis for caching and session management, MongoDB for user activity data (browsing history, favorites), RabbitMQ for delayed order cancellation, and MinIO/Aliyun OSS for file storage. Security is implemented with Spring Security and JWT, including dynamic path-based authorization. The codebase follows a layered architecture (Controller → Service → Mapper/DAO) with shared modules `mall-common` and `mall-security` providing reusable utilities for API responses, pagination, exception handling, Redis caching, and authentication. While heavily reliant on MyBatis Generator for data access objects and includes some long service methods, the overall structure is well-organized and modular, making it suitable as a reference for similar e-commerce projects. No data research or analytical components are present; this is purely an application codebase.
HotGo is a full-stack rapid application development framework built on GoFrame (Go) and Vue 3 (Naive UI). It provides an admin panel with RBAC, multi-tenancy, code generation, plugin/addon system, and integrations for payments (Alipay/WeChat/QQ), SMS, email, file storage (local/S3/MinIO/COS/OSS), message queues (Redis/Kafka/RocketMQ/disk), WebSocket real-time messaging, TCP server with RPC, and cron scheduling. The backend follows a modular service layer with generated DAO/entity patterns and custom ORM handlers for data filtering, tenant isolation, and sorting. The frontend is a dynamic SPA with built-in components for tables, forms, modals, uploads, and charts, plus i18n support. The codebase is production-ready but heavily relies on code generation and custom forks of GoFrame CLI tools, introducing some maintenance risk. Designed primarily for Chinese developers building enterprise admin systems.
FoalTS is a full-featured Node.js/TypeScript web framework structured as a monorepo with modular packages (core, CLI, JWT, TypeORM, GraphQL, storage, social auth, etc.). The framework provides declarative routing via decorators, a hook system for middleware/validation/authorization, dependency injection, and built-in support for OpenAPI, GraphQL, WebSockets, and file storage. Under the hood it uses Express, AJV, and TypeORM, with session stores for Redis, MongoDB, and SQL databases. The CLI generates projects, controllers, entities, and REST APIs, and includes upgrade commands across major versions. The codebase demonstrates solid engineering: thorough unit/e2e tests (over 2100 tests), documentation-as-tests, and a consistent pattern of abstract services (Store, Disk, Logger) resolved via configuration. Key reusable patterns include the hook/decorator system for validation and authentication, the abstract OAuth2 provider base class, and the CLI generator template engine. However, some deprecations (e.g., hashPassword→PasswordService) and outdated Docker images in development config indicate moderate technical drift. The project is actively maintained with frequent releases, daily CI on Node 22/24, and a well-documented upgrade path.
Ethr-DID is a TypeScript library that provides a high-level abstraction for creating, managing, and using `did:ethr` decentralized identifiers on Ethereum. It wraps the `ethr-did-resolver` and `did-jwt` libraries to enable operations such as signing and verifying JSON Web Tokens (JWTs), changing the owner of a DID, adding or revoking delegate signers, and setting or revoking public attributes (keys, services) on the Ethereum DID Registry smart contract. The library supports multiple Ethereum networks (mainnet, testnets, custom chains) and meta-transactions for gasless operations. It is designed for developers building self-sovereign identity solutions on Ethereum, particularly within the Veramo ecosystem. The codebase is well-tested with Jest and Ganache, uses modern ES modules and TypeScript, and follows semantic versioning with automated releases.