@lacspace/session
Encrypted, signed cookie sessions for any runtime — AES-256-GCM over Web Crypto with HKDF-stretched keys, secret rotation, rolling and absolute expiry, __Host- cookie rules enforced, a 10-minute OAuth state store and double-submit CSRF tokens. Works with Web Request/Response, Node http, Next.js, Hono, Express. Zero-dependency, isomorphic.
npm i @lacspace/sessionUsage
import { createCookieSession, createOAuthStateStore, createCsrf } from "@lacspace/session";
const sessions = createCookieSession<{ userId: string }>({ secrets: [process.env.SESSION_SECRET!], rolling: true });
const s = await sessions.read(request); // Cookie header, Web Request or Node req — never throws
if (!s.data) return unauthorized(s.reason); // "missing" | "tampered" | "expired" | …
headers.append("set-cookie", await sessions.commit({ userId: "u1" })); // __Host-session=v1.… AES-256-GCM
headers.append("set-cookie", sessions.destroy());
const oauthState = createOAuthStateStore({ secrets: [SECRET] }); // 10-minute { state, codeVerifier, nonce }
const csrf = createCsrf({ secrets: [SECRET] }); // tokens bound to s.idExports 14
createCookieSessioncreateOAuthStateStorecreateCsrfparseCookiesserializeCookieclearCookiegetCookiecookieHeaderOfsetFlashtakeFlashconstantTimeEqualrandomBytestoBase64urlfromBase64urlKeywords
More in Security Kit
Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, plus a storage-agnostic record toolkit: public fingerprints, hierarchical scopes, expiry, key rotation with a grace window, and revocation. Isomorphic over Web Crypto.
@lacspace/cryptoSafe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2/HKDF key derivation, SHA-256/384/512, HMAC, timing-safe compare and unbiased secure random (tokens, UUIDs, integers). Isomorphic (Node, edge, browser, RN).
@lacspace/headersSecure HTTP headers & a typed Content-Security-Policy builder — HSTS, CSP nonces & hashes, a typed Permissions-Policy, COOP/COEP/CORP cross-origin isolation, Reporting-Endpoints and report-only, plus ready-made strict and API presets. Framework-agnostic + Next.js. Zero-dependency, isomorphic.
@lacspace/jwtJSON Web Tokens over Web Crypto — HS/RS/ES/EdDSA signing, JWK/JWKS with kid-based key rotation, and strict expiry/issuer/audience/subject/jti checks. Plus refresh-token rotation and CSRF tokens. Isomorphic — Node, edge, browser.
@lacspace/lockAccount lockout & brute-force protection (server lock) — N-strikes with exponential or progressive/tiered backoff, per-account + per-IP composite locking, allow/deny lists, and a CAPTCHA step-up threshold before hard lockout. Pluggable store, zero-dependency, isomorphic.
@lacspace/mfaOrchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL), now with factor enrollment flows, failed-attempt lockout, trusted-device tokens and recovery codes. Isomorphic (bar @lacspace/otp).