Auth.js
@authjs

Authentication for the Web. Open Source. Full Stack. Own Your Data. For any JS framework/runtime.

authjs.dev
Joined June 2020
25 Photos and videos
Load newest
💡 We are proposing a new way to add authentication/authorization to your app or a subdirectory in a single line using @nextjs Middleware! See the proposal PR here: github.com/nextauthjs/next-a… Please leave a comment/feedback if interested! 🙏
Code example. Gist available at https://gist.github.com/balazsorban44/da104a7549ae1c302f97b1b0b7ef4f3b

ALT Code example. Gist available at https://gist.github.com/balazsorban44/da104a7549ae1c302f97b1b0b7ef4f3b

20
44
557
Minor release update: 🔒️@Twitter OAuth 2.0 is now supported (opt-in) by the `latest` version! Check out, give us feedback. 🔒️ @patreon Provider added 🔒️ Better OIDC (id_token) detection added 🔒️ Also fixed some bugs 🐛 github.com/nextauthjs/next-a…

Release v4.1.0 · nextauthjs/next-auth

4.1.0 (2022-01-10) Bug Fixes display inline errors when using custom error page. (#3576) (82447f8) oauth: set httpOptions before issuer discovery (#3537) (c71cb84) providers: fix url and auth met...

github.com
1
3
23
See how to opt-in to Twitter OAuth 2 here: next-auth.js.org/providers/t…

Twitter | NextAuth.js

Twitter is currently the only built-in provider using the OAuth 1.0 spec. This means that you won't receive an accesstoken or refreshtoken, but an oauthtoken and oauthtoken_secret respectively....

next-auth.js.org
5
If you want to learn about Web Security, give this course by @feross a go!
Addy Osmani
@addyosmani
4 Jan 2022
A full free Stanford course on Web Security: stanford.io/2UHIu65 & all the videos too: bit.ly/web-se-vids by @feross 🍪 HTTP(S), Cookies, Sessions 🛡 Same Origin Policy 👿 Cross-Site Scripting (XSS) ☠️ Cross-Site Script Inclusion 🔑 WebAuthn and more.
Demo: Is cross-origin fetch allowed? From https:/web.stanford.edu/class/cs253/: const res = await fetch('https://axess.stanford.edu') const data = await res.body.text() console.log(data) No! Would be a huge violation of Same Origin Policy. Any site in the world could read your grades if you're logged into Axess in another tab!

ALT Demo: Is cross-origin fetch allowed? From https:/web.stanford.edu/class/cs253/: const res = await fetch('https://axess.stanford.edu') const data = await res.body.text() console.log(data) No! Would be a huge violation of Same Origin Policy. Any site in the world could read your grades if you're logged into Axess in another tab!

1
5
33
Twitter OAuth 2 support is coming soon to NextAuth.js! 🎉
Balázs Orbán@balazsorban44
14 Dec 2021
I'm so happy to have decided to give my opinion in their beta phase! The /users/me endpoint was my suggestion! 😊 Nice work, Twitter! 🙏
2
14
v4 is out! 🚀📦️ 🔒️ Improved Providers (better OAuth, OIDC support) 🔒️ Improved Adapters 🔒️ More secure/consistent by default 🔒️ Middleware Support 🔒️ Fully rewritten in TypeScript 🔒️ Decoupled core from API Routes 🔒️ ... and more! `npm i next-auth@latest`
13
50
356
Honorable mentions ◆ Custom brand color/logo on built-in pages 💅 ◆ Session cookie chunking (no session size limit with JWT) ◆ 10x reduced install size (by decoupling the TypeORM adapter from core) (edited)
10
Decoupled from API Routes ◆ (Experimental) `getServerSession` for faster session access on backends (github.com/nextauthjs/next-a…) ◆ Opens up `next-auth` for frameworks other than Next.js! SvelteKit, Nuxt, Express, etc. (github.com/nextauthjs/next-a…)

Server-side HTTP requests via `getSession` usually get extremely slow on Vercel · Issue #1535 ·...

Describe the bug Before further ado, here’s a comparison between a /api/user/{id} request which fetches /api/auth/session through the network even on the server side, versus a /api/site/{id} call, ...

github.com
2
16
TypeScript ◆ Means increased confidence for our users ◆ Safe and rapid iteration for us ◆ All Adapters are written in TypeScript as well
7
Middleware Support ◆ Use `getToken` in Next.js `_middleware` when using JWT sessions. (Database session support is being evaluated.) Example at our next-auth-example repo, will be documented soon as well. github.com/nextauthjs/next-a…

GitHub - nextauthjs/next-auth-example: Example showing how to use NextAuth.js with Next.js

Example showing how to use NextAuth.js with Next.js - nextauthjs/next-auth-example

github.com
2
15
Improved Providers ◆ Now uses `oidc-client` for better compliance. Thanks @panva! (For compatibility: github.com/nextauthjs/next-a…) Will deprecate OAuth 1.x, only used by @twitter, they are in the process of upgrading. ◆ Introduced several new built-in providers

Manually Test Providers (v4) · Issue #2524 · nextauthjs/next-auth

Description 📓 Before the release of v4 we want to manually test most (if not all) the current OAuth providers to make sure the changes that happen on v4 to their configuration didn't break any ...

github.com
3
7
Security ◆ Audited source code ◆ JWT sessions using encryption (JWE) by default. Thanks, @_panva! Consistency: ◆ Named parameters across public APIs for less verbose configuration ◆ Upfront config assertion to catch misconfiguration early
2
* @_panva
3
Improved Adapters ◆ Stricter evaluation for consistency ◆ Reduced core size by being modular ◆ Drastically simplified API ◆ Easier, more extensible initialization ◆ Support for: @prisma, @fauna, @MongoDB, @neo4j, @SequelizeJS, @dgraphlabs, @MikroOrm, @dynamodb, @typeormjs
1
11
Most of you who follow me probably know me by my work at @nextauthjs, but here is a small intro to it, and how I got involved in the project, thanks to @iaincollins! balazsorban.com/blog/next-au…

Intro to NextAuth.js and my involvement - Balázs Orbán

How I started maintaining the most popular(?) Next.js auth library

balazsorban.com
2
2
18
New beta (hopefully the last... 🤫) is out! 🔒️ fixed a few bugs 🐛 🔒️ cookie chunking 🔒️ clock skew/timeout tolerance 🔒️ introduced some small breaking changes, (should be covered in the migration docs), for more secure defaults Changelog here: github.com/nextauthjs/next-a…

Release v4.0.0-beta.7 · nextauthjs/next-auth

4.0.0-beta.7 (2021-11-15) Bug Fixes providers: set 42 default scope (#3189) (38cefdd) allow configuring http timeout (#3188) (b871b47) bump openid-client (#3063) (da991de), closes #3052 correctly ...

github.com
2
5
23
PlanetScale
@PlanetScale
15 Nov 2021
Launch week is live! Stay tuned for all of our daily releases. Today, we released a new PlanetScale Next.js starter app! We're excited to share how NextAuth.js, @netlify, @prisma, and PlanetScale work together. planetscale.com/blog/nextjs-…
8
Magic Labs
@magic_labs
12 Nov 2021
Replying to @magic_labs
TYSM Adam, for making some ✨magic✨ for the Magic community! 🪄 Adam's super rad Recipe Book: ajax-recipes.vercel.app/logi… 🪄 Use the Magic Login Form with Next-Auth: github.com/AJax2012/magic-wi…
7
Hi @clerk thanks for supporting @nextauthjs through @opencollect! 🎉😊💚 (If you or your company enjoys next-auth, consider checking out opencollective.com/nextauth)

Auth.js - Open Collective

Working on open source libraries for authentication

opencollective.com
1
2
8
This happened overnight, but NextAuth.js already supports Next.js 12 Middleware, if you are using (the default) JWT sessions!
Balázs Orbán@balazsorban44
27 Oct 2021
Replying to @nextauthjs
Some code for you: gist.github.com/balazsorban4…
3
2
49
Load more