@sveinssons-dev/form-kit-redis

Redis-backed nonce and rate-limit stores for Sveinssons Form Kit.

npm install @sveinssons-dev/form-kit-redis

Public exports include RedisNonceStore, RedisRateLimitStore, namespace helpers, and the driver-neutral RedisStoreClient contract. Requires Node.js 24.11.0 or later and an injected Redis client; pair it with form-kit-server.

Nonce store — authority and requirements

RedisNonceStore uses an atomic Lua script (EVAL) that reads Redis TIME and performs SET NX PXAT in a single atomic operation. Redis 7+ is required for effects-replication semantics (TIME in a writing script).

Authority change (v2.0.0): Nonce expiry is now determined by Redis TIME, not by the calling application's clock. The clock option on RedisNonceStoreOptions is deprecated and has no effect on expiry decisions; it will be removed in a future release.

Operational requirements for the nonce replay guarantee:

• Use maxmemory-policy noeviction (or a provider-documented equivalent) so that an out-of-memory condition errors writes rather than silently evicting live nonce claims.
• One authoritative Redis primary per security namespace. Active-active multi-master and eventual-consistency topologies are not supported.
• No authority clock discontinuity (no forward jump followed by backward reset) during any live nonce's validity interval.
• If Redis state is lost or an unsafe failover occurs, recover in this order: (1) pause new admissions; (2) terminate or drain old in-flight workers and any queued/delayed commands so an already-verified request cannot complete a late write; (3) invalidate outstanding tokens; then (4) establish a fresh authority and resume. Signing-secret rotation alone does not stop a request that an old worker has already verified — it must be combined with draining that in-flight work. Do not assume missing keys are unclaimed.
• Application clocks should be within 1,000 ms of Redis time (NTP-synchronized) for token minting, future-skew, and minimum-completion timing, even though nonce expiry itself is now authority-controlled.

Not guaranteed without the above conditions: This library cannot detect eviction, replication loss, or clock discontinuity from within a request. Do not claim unconditional replay protection without verifying the operational contract.

Source is maintained in a private repository. Proprietary software; see LICENSE.