René's URL Explorer Experiment

Title: feat(server): session/auth/CSRF/guard primitives + graduate toward Stable (#131, #132) by JosunLP · Pull Request #153 · bQuery/bQuery · GitHub

Open Graph Title: feat(server): session/auth/CSRF/guard primitives + graduate toward Stable (#131, #132) by JosunLP · Pull Request #153 · bQuery/bQuery

X Title: feat(server): session/auth/CSRF/guard primitives + graduate toward Stable (#131, #132) by JosunLP · Pull Request #153 · bQuery/bQuery

Description: Collected work for the two open server tickets, landed in one branch and targeting dev. Closes #131. Closes #132. #132 — session, auth, and middleware primitives session() + memoryStore() — HMAC-signed session-id cookie (Web Crypto, cross-runtime), payload in a pluggable SessionStore (in-memory default; bring-your-own Redis/DB without bundling a client). ctx.session is a Proxy: payload via plain props, lifecycle via $id / $isNew / $data / $regenerate / $destroy / $clear. Includes secret rotation, rolling sessions, prototype-pollution filtering, and session-fixation defense. csrf() + csrfToken() — OWASP double-submit cookie (signed when a secret is supplied); token via x-csrf-token header or _csrf body field. Composes with the security module (integrity vs. output). guard() — predicate route guard mirroring the router's guard ergonomics. basicAuth() / bearerAuth() — Authorization parsing with a verify() hook; resolved user on ctx.state. Signing utilities — signValue / unsignValue / timingSafeEqual / randomToken / randomId / base64Url*, all on globalThis.crypto.subtle (no node:crypto). Shared cookie helpers extracted to src/server/cookies.ts (+ appendSetCookie); no behavioral change to existing ctx.setCookie. #131 — promote server toward Stable Guide Stability section: exit-criteria checklist, frozen ctx/app surface, per-runtime support matrix; intro + README notes; version history. app.listen() now supports Deno via Deno.serve (Node/Bun/Deno covered). ctx.session is additive/optional — no breaking changes to the 1.14 surface. New exports wired through server/index.ts and the /full bundle. Zero-dependency & secure-by-default No runtime dependencies added; each primitive is independently importable/tree-shakeable. Sessions default to httpOnly + SameSite=Lax; signing is HMAC-SHA-256; comparisons are constant-time. Verification Full suite 2785 pass / 0 fail (42 new in tests/server-stable.test.ts: sessions, CSRF, guards, auth, crypto — incl. secret rotation, rolling, $destroy-revive, immutable-response cookies). Cross-runtime smoke extended for server (sign/verify, session, CSRF) — passes on Node + Bun locally; Deno in CI. tsc, eslint, bun run build, check:full-bundle (in sync), check:doc-exports (server 23/23) all green. Review Ran an adversarial multi-agent review of the diff; applied the confirmed hardening: don't cache a rejected HMAC key-import, guard timingSafeEqual against empty input, revive a session written-to after $destroy(), simplify the Deno listen() address resolution, and strengthened tests/docs. 🤖 Generated with Claude Code

Open Graph Description: Collected work for the two open server tickets, landed in one branch and targeting dev. Closes #131. Closes #132. #132 — session, auth, and middleware primitives session() + memoryStore() — HMAC-s...

X Description: Collected work for the two open server tickets, landed in one branch and targeting dev. Closes #131. Closes #132. #132 — session, auth, and middleware primitives session() + memoryStore() — HMAC-s...

Opengraph URL: https://github.com/bQuery/bQuery/pull/153

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width