File contents Vue SSR Auth
Owns the authentication flow, security patterns, session management, and access control.
Auth flow: Signup → Verify → Dashboard
POST /api/auth/signup → creates user, generates 6-digit code (crypto.randomInt), hashes SHA-256
Email sent with code → user enters in VerifyCodeView
POST /api/auth/verify-code → verifyCode() uses timingSafeEqual, creates session
Redirect to /:locale/dashboard
Security constants
Constant
Value
Purpose
SECURITY_CODE_EXPIRY_MS
600000
10 minutes code validity
SECURITY_CODE_MAX_ATTEMPTS
3
Max verification attempts
RESEND_COOLDOWN_MS
30000
30s between resends
BCRYPT_ROUNDS
10
Password hash cost
Security features
Code generation: crypto.randomInt (not Math.random)
Code hashing: SHA-256 hex (not base64)
Code verification: timingSafeEqual (not string compare)
Session destruction after password/email change
Rate limiting per endpoint type
COOKIE_SECRET validated in production
IP blocking for brute-force prevention
Session management
express-session with session-file-storeSessions stored in ./sessions/ directory (persist across dev restarts)
req.session.userId is a string — convert with new ObjectId(str)destroyUserSessions(userId, excludeSessionId) — deletes all except current
Captcha integration
Server (shared/captcha.js): Verifies reCAPTCHA v3 token via Google APIClient (composables/useCaptcha.js): Loads script, exposes execute(action)Gracefully skipped if RECAPTCHA_SITE_KEY is not configured
Middleware
requireAuth — checks req.session.userId existsrequireAdmin — checks user type via isAdmin()
Where to look
Source: e-xode/vue-ssr — distributed by TomeVault .
1 --- 2 name: e-xode-vue-ssr-vue-ssr-auth 3 description: Vue SSR Auth 4 --- 5 6 # Vue SSR Auth 7 8 > Owns the authentication flow, security patterns, session management, and access control. 9 10 ## Auth flow: Signup → Verify → Dashboard 11 12 1. POST /api/auth/signup → creates user, generates 6-digit code (`crypto.randomInt`), hashes SHA-256 13 2. Email sent with code → user enters in VerifyCodeView 14 3. POST /api/auth/verify-code → `verifyCode()` uses `timingSafeEqual`, creates session 15 4. Redirect to `/:locale/dashboard` 16 17 ## Security constants 18 19 | Constant | Value | Purpose | 20 | -------------------------- | ------ | ------------------------- | 21 | SECURITY_CODE_EXPIRY_MS | 600000 | 10 minutes code validity | 22 | SECURITY_CODE_MAX_ATTEMPTS | 3 | Max verification attempts | 23 | RESEND_COOLDOWN_MS | 30000 | 30s between resends | 24 | BCRYPT_ROUNDS | 10 | Password hash cost | 25 26 ## Security features 27 28 - Code generation: `crypto.randomInt` (not Math.random) 29 - Code hashing: SHA-256 hex (not base64) 30 - Code verification: `timingSafeEqual` (not string compare) 31 - Session destruction after password/email change 32 - Rate limiting per endpoint type 33 - COOKIE_SECRET validated in production 34 - IP blocking for brute-force prevention 35 36 ## Session management 37 38 - `express-session` with `session-file-store` 39 - Sessions stored in `./sessions/` directory (persist across dev restarts) 40 - `req.session.userId` is a string — convert with `new ObjectId(str)` 41 - `destroyUserSessions(userId, excludeSessionId)` — deletes all except current 42 43 ## Captcha integration 44 45 - **Server** (`shared/captcha.js`): Verifies reCAPTCHA v3 token via Google API 46 - **Client** (`composables/useCaptcha.js`): Loads script, exposes `execute(action)` 47 - Gracefully skipped if RECAPTCHA_SITE_KEY is not configured 48 49 ## Middleware 50 51 - `requireAuth` — checks `req.session.userId` exists 52 - `requireAdmin` — checks user type via `isAdmin()` 53 54 ## Where to look 55 56 | If you need… | Read | 57 | -------------------------- | ------------------------------------------------------------ | 58 | Full security flow details | [references/security-flow.md](./references/security-flow.md) | 59 60 --- 61 > Source: [e-xode/vue-ssr](https://github.com/e-xode/vue-ssr) — distributed by [TomeVault](https://tomevault.io). 62 <!-- tomevault:4.0:skill_md:2026-05-24 -->
commit 6b08ec36d6
Frequently asked questions How do I install the E Xode Vue Ssr Vue Ssr Auth skill? Run npx skillmds@latest add tomevault-io/e-xode-vue-ssr-vue-ssr-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
What does the E Xode Vue Ssr Vue Ssr Auth skill do? Vue SSR Auth It is listed under Web & Frontend on SkillMD.
Is E Xode Vue Ssr Vue Ssr Auth safe to use? This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
Which AI agents work with E Xode Vue Ssr Vue Ssr Auth? This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Is E Xode Vue Ssr Vue Ssr Auth free to use? Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
Who published E Xode Vue Ssr Vue Ssr Auth? tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tomevault-io