Auth Wave is a robust authentication and user management service that simplifies secure user access for applications. It provides multiple authentication methods, comprehensive security features, and multi-project support, allowing developers to implement enterprise-grade authentication without building complex security infrastructure from scratch. Built with modern technologies, Auth Wave handles everything from user registration and verification to session management and security logging.

• Email/Password Authentication: Traditional authentication method
• Magic URL Authentication: Passwordless login via email links
• OTP Authentication: One-time passwords sent via email
• Session Management: Handles multiple user sessions with device and user-agent tracking

• User registration and account creation
• Email verification system
• Password reset functionality
• Account lockout protection
• User verification status tracking

• Multi-project support (each client application is a separate project)
• Project-specific configurations
• Custom email template support for each project
• Project-level user limits and restrictions

The service implements comprehensive security logging to track various user activities and authentication attempts- login, logout, failed login attempts, user-verification, account-lockouts, etc.

• Admin authentication system
• Project creation and management
• User monitoring capabilities
• Security log access and analysis
• Project configuration management

AuthWave employs JWT-based authentication with separate access and refresh tokens to enhance security. It features token expiration handling to automatically invalidate tokens after a set duration, reducing unauthorized access risks.

AuthWave ensures password security by hashing all user passwords using bcrypt, enforcing strict password format validations and strength requirements to prevent weak credentials. Additionally, it incorporates a secure password reset mechanism, allowing users to safely reset their passwords through verified email links.

AuthWave implements rate limiting to prevent abuse and protect the service from excessive requests. It uses a combination of IP address, user-agent, and endpoint to track and limit request rates, ensuring fair usage and preventing abuse.

AuthWave manages user sessions securely by tracking devices and user-agents. It implements session expiration and also allows for session revocation, enabling administrators (and users themselves) to terminate active sessions for specific users. Moreover, it also checks for multiple logins from the same device and user-agent.

AuthWave enforces user limits per project and session limits per user to ensure optimal resource management and security. Administrators can customize security settings to align with organizational policies, while project-specific authentication method controls provide flexibility in managing access protocols tailored to each project's unique requirements.

AuthWave enhances account protection by enforcing account lockouts after multiple failed login attempts, requiring email verification for new accounts, providing a secure password reset flow, and sending emails to the user's email address to notify them about their account activities.

Every controller and business logic in AuthWave's backend ensures data protection by implementing sensitive data filtering, secure cookie handling, and input validation and sanitization. It follows MongoDB security best practices, including robust encryption and access controls to safeguard user information.

AuthWave's backend endpoints are secured using unique project-keys and project-ids generated by administrators via the developer console on the AuthWave website. Administrators also have the ability to regenerate project-keys as needed to maintain security in case of potential compromises.

• Separation of concerns and a modular design that promotes maintainability and scalability.
• Leveraging TypeScript provides strong type safety throughout the codebase, while clear error handling mechanisms enhance reliability and debuggability.
• Scalability considerations such as database indexing for optimized data retrieval, efficient query patterns to minimize latency, pagination support for handling large datasets, and resource limiting to manage system resources effectively.

MIT License

Copyright (c) 2024 Abhijeet Gautam

This software is provided "as is" and free to use. The author disclaims all warranties and liabilities. You are free to use, modify, copy, distribute this software for any purpose, commercial or non-commercial.

By using this software, you agree that:

1. The author takes no responsibility for any damages or issues arising from the use of this software

2. You will not hold the author legally liable for anything related to this software

3. You understand this is provided without any warranty or guarantee of any kind

4. You use this software at your own risk

The above copyright notice and this disclaimer must be included in all copies or substantial portions of the Software.

For full details of the MIT License under which this software is released, please refer to: MIT License

• FRONTEND: Next.js, Tailwind CSS, Shadcn UI
• BACKEND: Node.js, Express.js, TypeScript
• DATABASE: MongoDB (Mongoose ODM)
• API Testing: Postman