Open-source authentication system because I got tired of rewriting login flows for every project. Built once, used everywhere. (Discontinued superseded by project-specific auth implementations.)
Authn started from a simple frustration. I kept rewriting the same login system for every project. So I built it once, properly, and open-sourced it.
It's a self-hosted authentication platform built on Node.js, Express, and MongoDB with 19 integrated security features. The goal was to match what commercial solutions like Auth0 or Firebase Auth offer, but with zero vendor lock-in and zero per-user costs.
What's included
Authentication methods: Email/password with bcryptjs (12 salt rounds), Google OAuth 2.0 via Firebase Admin SDK, and TOTP-based two-factor authentication with backup codes.
Security layer: Progressive rate limiting (5 auth attempts per 15 minutes), account lockout after 10 failed attempts, device fingerprinting with new-device email alerts, and session management capped at 5 concurrent sessions per user. JWT tokens stored in HTTP-only cookies with SameSite: Strict.
User management: Full profile system with avatar uploads (Sharp processing), RBAC with four predefined roles, email verification via OTP, and GDPR-compliant data export and account deletion with mandatory encrypted backups (AES-256).
Automated maintenance: node-cron handles daily session cleanup, weekly backup pruning, and monthly inactive device removal.
Architecture
Seven distinct layers: middleware, models, routes, services, utils, public assets, and maintenance scripts. MongoDB schemas cover 30+ fields per user. Designed to be dropped into any Node.js project without restructuring your existing codebase.
Honest assessment
Security is solid, 9/10. Documentation is thorough. The gaps are test coverage (~30%, targeting 80%) and observability tooling. Redis integration for session storage and a refresh token mechanism are the next major additions. Production readiness sits at 72%, enough for real projects, not yet enterprise-hardened.
Full API reference and deployment guides (Docker, PM2, Nginx, AWS, Kubernetes) are available at the docs site.