Built with SQLite.
- Password checks with HaveIBeenPwned
- Sign in with passkeys
- Email verification
- 2FA with TOTP
- 2FA recovery codes
- 2FA with passkeys and security keys
- Password reset with 2FA
- Login throttling and rate limiting
Emails are just logged to the console. Rate limiting is implemented using JavaScript Map.
Create sqlite.db and run setup.sql.
sqlite3 sqlite.db
Create a .env file. Generate a 128 bit (16 byte) string, base64 encode it, and set it as ENCRYPTION_KEY.
ENCRYPTION_KEY="L9pmqRJnO1ZJSQ2svbHuBA=="You can use OpenSSL to quickly generate a secure key.
openssl rand --base64 16
Install dependencies and run the application:
pnpm i
pnpm dev
- We do not consider user enumeration to be a real vulnerability so please don't open issues on it. If you really need to prevent it, just don't use emails.
- This example does not handle unexpected errors gracefully.
- There are some major code duplications (specifically for 2FA) to keep the codebase simple.
- Astro warns about unused functions (
get2FARedirect()) but this is a bug with the language server. - TODO: Passkeys will only work when hosted on
localhost:4321. Update the host and origin values before deploying. - TODO: You may need to rewrite some queries and use transactions to avoid race conditions when using MySQL, Postgres, etc.
- TODO: Users are not shown their recovery code when they first register their second factor.
- TODO: This project relies on the
X-Forwarded-Forheader for getting the client's IP address. - TODO: Logging should be implemented.