Nexis authentication integration

What Nexis provides and what it does not

Nexis v1.3.3 provides storage-agnostic createSession, secure cookie defaults, Actions, and production middleware hooks. It does not ship a user database, password flow, OAuth client, SSO provider, or session persistence implementation.

Choose an identity provider or own credential system explicitly.
Persist only an opaque session identifier in the cookie.
Provide a durable SessionStore backed by your database or cache.

Resolve the session on the server

Use createSession with an application-owned SessionStore, then resolve the principal from its opaque HttpOnly cookie. Do not trust a hidden field, client claim, or localStorage token as authorization.

Keep Secure, HttpOnly, SameSite=Lax or stricter attributes.
Rotate session IDs after login and privilege changes.
Expire, revoke, and audit sessions deliberately.

Protect output as well as mutations

A static page cannot become private by hiding a link. Private HTML needs a server-rendered or application-handled route with an authentication guard before output is generated.

Use private/no-store caching for authenticated pages.
Redirect only to validated local return paths.
Keep public and account route trees separate.

Session integration · Nexis primitive plus application-owned storageTypeScript

import { createSession } from '@mohammedaydan/security'

// sessionStore is implemented by the application with a database, Redis, or similar durable store.
const sessions = createSession(sessionStore, {
  cookie: { maxAge: 60 * 60 * 8 },
})

export async function requirePrincipal(request: Request) {
  const { principal } = await sessions.require(request)
  return principal
}

export function sessionCookie(sessionId: string): string {
  return sessions.setCookie(sessionId)
}

SCOPE BOUNDARY

Do not confuse a pattern with a built-in.

This is an application integration pattern. Add password hashing, OIDC/OAuth verification, MFA, account recovery, and session persistence through vetted application services.

PRACTICE LAB

Prove the behavior.

Create login, logout, and revoked-session tests. Confirm the session cookie is HttpOnly and never appears in client HTML or logs.