Loading documentation...
Learn how Operator handles user authentication, Argon2 hashing, and session management.
Operator features an independent, self-hosted authentication system implemented in src/server/actions/auth.ts and src/lib/auth/:
- Zero reliance on external paid auth vendors like Clerk or Supabase Auth.
- Full ownership of user records in the local users table.
- Cryptographically secure cookie-based session tokens stored in sessions.
User passwords are encrypted using Argon2id via the native @node-rs/argon2 library:
- State-of-the-art memory-hard password hashing algorithm resistant to GPU cracking.
- Salt is generated cryptographically per user.
Upon successful authentication:
1. A cryptographically random session token is generated.
2. The session record is saved in sessions with user agent, IP address, and an expiration timestamp (30 days for *Remember Me*, 24 hours standard).
3. An httpOnly, secure, sameSite: "lax" cookie named session_token is set on the browser.
4. Active sessions benefit from sliding expiration: ongoing user activity refreshes the session lifespan.
Users can also authenticate with Google:
- Initiation endpoint: POST /api/auth/login/google redirects to Google OAuth 2.0 consent.
- Callback endpoint: GET /api/auth/callback/google verifies authorization code, upserts the users record, and issues an active session.