ESLint rules that harden auth-cookie defaults (httpOnly, secure) and bcrypt rounds. Defense-in-depth for the cookie-config helper pattern.

UserKit for the Next.js App Router: route handlers that keep the session in an httpOnly cookie, server-side session reads, and a route guard.

DSH web plugin: password-gate authentication (login page + HttpOnly signed cookie) for exposing dsh web behind a reverse proxy

Next.js App Router proxy bridge for token-based backend authentication with httpOnly cookies, refresh retry, and response sanitization.

Signed, HttpOnly server-side sessions for Blok — pluggable store (memory / sqlite / postgres / redis), session.get/set/forget/regenerate nodes, and the inertia.session middleware.

Secure JWT authentication for React and Next.js — HttpOnly server sessions, verified tokens, CSRF built in.

AG-UI-compatible TypeScript client for the Surogates public-website channel. Wraps the publishable-key bootstrap, HttpOnly cookie, CSRF double-submit, and SSE streaming behind a standard AbstractAgent so widgets built for AG-UI work out of the box.

MoriaJS auth — JWT + httpOnly cookies, pluggable auth system

Backend-for-Frontend for SPAs using Authagonal. Runs the OIDC auth-code + PKCE flow server-side, holds tokens in a server-side session, and exposes the browser only an httpOnly cookie. Express + Next.js adapters.

WebUI authentication plugin for DeepSeek Harness: password or OIDC/SSO login enforced at the HTTP/transport layer, with server-side sessions, HttpOnly cookies and audit logging. Zero dependencies.

Check if a URL is absolute

BFF authentication module — Keycloak OIDC, Redis sessions, httpOnly cookies

L2 server package of SIWX (TUWA): backend verification of CAIP-122 sign-ins for EVM and Solana, single-use nonce and session stores, HttpOnly cookie helpers and Next.js App Router handlers.

Server-side OIDC session for a NestJS backend-for-frontend: the browser holds one httpOnly cookie and never a Xema token. Performs the authorization-code exchange, keeps the token set in a session store the application owns, refreshes it under a lease so

Cookie storage adapter for swr-login (works with BFF pattern for HttpOnly cookies)

Middleware for Express.js for setting HttpOnly cookie and get access to existance of this cookie

React authentication middleware for University of Jaffna Auth Service with OAuth 2.0 + PKCE, httpOnly cookies, time-bound roles and permissions

The official UniDir SDK for Next.js applications. This SDK provides secure, server-side OpenID Connect (OIDC) authentication using encrypted `httpOnly` cookies.

Shared passkey auth (WebAuthn + HttpOnly cookies) for Next.js apps

MyBid SSO client surface: session read via /v1/me, refresh + logout gateway calls, sign-in/up URL builders. HttpOnly cookie model — never stores or writes tokens itself.