@kimoxstudio/auth

Auth provider and rate limiting.

A single-user credentials provider with HMAC-signed session cookies, plus an in-memory rate limiter for login attempts.

import { createCredentialsAuthProvider, createMemoryRateLimiter }
  from "@kimoxstudio/auth";

const auth = createCredentialsAuthProvider({
  user: process.env.KX_ADMIN_USER!,
  password: process.env.KX_ADMIN_PASSWORD!,
  sessionSecrets: [{ id: "v1", value: process.env.KX_SESSION_SECRET! }],
  rateLimiter: createMemoryRateLimiter({ points: 5, durationMs: 60_000 }),
});

Never ship default/placeholder secrets to production — the session cookie is an HMAC over its signing key, so a known key means forgeable admin sessions. On serverless, prefer a distributed rate limiter: the in-memory one is per instance.

Part of kimox-fw

kimox-fw is a JSON-document + template site framework for Next.js (App Router): pages are declarative JSON documents rendered by Zod-typed templates, with content stored in git and edited through a visual admin using draft branches ("variations").

Scaffold a whole site with npx create-kx-app.

MIT © Kimox Studio