forked from nextauthjs/next-auth
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
docs(security): email contact update (nextauthjs#2467)
* chore(docs): email contact update * chore(docs): add [email protected] back
- Loading branch information
Showing
3 changed files
with
49 additions
and
53 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,22 +14,22 @@ appearance, race, religion, or sexual identity and orientation. | |
| Examples of behavior that contributes to creating a positive environment | ||
| include: | ||
|
|
||
| * Using welcoming and inclusive language | ||
| * Being respectful of differing viewpoints and experiences | ||
| * Gracefully accepting constructive criticism | ||
| * Focusing on what is best for the community | ||
| * Showing empathy towards other community members | ||
| - Using welcoming and inclusive language | ||
| - Being respectful of differing viewpoints and experiences | ||
| - Gracefully accepting constructive criticism | ||
| - Focusing on what is best for the community | ||
| - Showing empathy towards other community members | ||
|
|
||
| Examples of unacceptable behavior by participants include: | ||
|
|
||
| * The use of sexualized language or imagery and unwelcome sexual attention or | ||
| advances | ||
| * Trolling, insulting/derogatory comments, and personal or political attacks | ||
| * Public or private harassment | ||
| * Publishing others' private information, such as a physical or electronic | ||
| address, without explicit permission | ||
| * Other conduct which could reasonably be considered inappropriate in a | ||
| professional setting | ||
| - The use of sexualized language or imagery and unwelcome sexual attention or | ||
| advances | ||
| - Trolling, insulting/derogatory comments, and personal or political attacks | ||
| - Public or private harassment | ||
| - Publishing others' private information, such as a physical or electronic | ||
| address, without explicit permission | ||
| - Other conduct which could reasonably be considered inappropriate in a | ||
| professional setting | ||
|
|
||
| ## Our Responsibilities | ||
|
|
||
|
|
@@ -55,11 +55,11 @@ further defined and clarified by project maintainers. | |
| ## Enforcement | ||
|
|
||
| Instances of abusive, harassing, or otherwise unacceptable behavior may be | ||
| reported by contacting [email protected]. All complaints will be reviewed and | ||
| investigated and will result in a response that is deemed necessary and | ||
| appropriate to the circumstances. The project team is obligated to maintain | ||
| confidentiality with regard to the reporter of an incident. Further details of | ||
| specific enforcement policies may be posted separately. | ||
| reported by contacting [email protected] or [email protected] and [email protected]. | ||
| All complaints will be reviewed and investigated and will result in a response | ||
| that is deemed necessary and appropriate to the circumstances. The project team | ||
| is obligated to maintain confidentiality with regard to the reporter of an | ||
| incident. Further details of specific enforcement policies may be posted separately. | ||
|
|
||
| Project maintainers who do not follow or enforce the Code of Conduct in good | ||
| faith may face temporary or permanent repercussions as determined by other | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,11 +14,11 @@ We request that you contact us directly to report serious issues that might impa | |
|
|
||
| If you contact us regarding a serious issue: | ||
|
|
||
| * We will endeavor to get back to you within 72 hours. | ||
| * We will aim to publish a fix within 30 days. | ||
| * We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released. | ||
| * If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly. | ||
| - We will endeavor to get back to you within 72 hours. | ||
| - We will aim to publish a fix within 30 days. | ||
| - We will disclose the issue (and credit you, with your consent) once a fix to resolve the issue has been released. | ||
| - If 90 days has elapsed and we still don't have a fix, we will disclose the issue publicly. | ||
|
|
||
| Currently, the best way to report an issue is by emailing [email protected] | ||
| Currently, the best way to report an issue is by contacting us via email at [email protected] or [email protected] and [email protected]. | ||
|
|
||
| For less serious issues (e.g. RFC compliance for unsupported flows or potential issues that may cause a problem future or default behaviour / options) it is appropriate to submit these these publically as bug reports or feature requests or to raise a question to open a discussion around them. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,13 +23,11 @@ You can use also NextAuth.js with any database using a custom database adapter, | |
|
|
||
| ### What authentication services does NextAuth.js support? | ||
|
|
||
|
|
||
| <p>NextAuth.js includes built-in support for signing in with | ||
| {Object.values(require("../providers.json")).sort().join(", ")}. | ||
| (See also: <a href="/configuration/providers">Providers</a>) | ||
| </p> | ||
|
|
||
|
|
||
| NextAuth.js also supports email for passwordless sign in, which is useful for account recovery or for people who are not able to use an account with the configured OAuth services (e.g. due to service outage, account suspension or otherwise becoming locked out of an account). | ||
|
|
||
| You can also use a custom based provider to support signing in with a username and password stored in an external database and/or using two factor authentication. | ||
|
|
@@ -58,7 +56,6 @@ NextAuth.js is designed as a secure, confidential client and implements a server | |
|
|
||
| It is not intended to be used in native applications on desktop or mobile applications, which typically implement public clients (e.g. with client / secrets embedded in the application). | ||
|
|
||
|
|
||
| ### Is NextAuth.js supporting TypeScript? | ||
|
|
||
| Yes! Check out the [TypeScript docs](/getting-started/typescript) | ||
|
|
@@ -83,26 +80,25 @@ If you are using a database with NextAuth.js, you can still explicitly enable JS | |
|
|
||
| ### Should I use a database? | ||
|
|
||
| * Using NextAuth.js without a database works well for internal tools - where you need to control who is able to sign in, but when you do not need to create user accounts for them in your application. | ||
| - Using NextAuth.js without a database works well for internal tools - where you need to control who is able to sign in, but when you do not need to create user accounts for them in your application. | ||
|
|
||
| * Using NextAuth.js with a database is usually a better approach for a consumer facing application where you need to persist accounts (e.g. for billing, to contact customers, etc). | ||
| - Using NextAuth.js with a database is usually a better approach for a consumer facing application where you need to persist accounts (e.g. for billing, to contact customers, etc). | ||
|
|
||
| ### What database should I use? | ||
|
|
||
| Managed database solutions for MySQL, Postgres and MongoDB (and compatible databases) are well supported from cloud providers such as Amazon, Google, Microsoft and Atlas. | ||
|
|
||
| If you are deploying directly to a particular cloud platform you may also want to consider serverless database offerings they have (e.g. [Amazon Aurora Serverless on AWS](https://aws.amazon.com/rds/aurora/serverless/)). | ||
|
|
||
|
|
||
| --- | ||
|
|
||
| ## Security | ||
| ## Security | ||
|
|
||
| ### I think I've found a security problem, what should I do? | ||
|
|
||
| Less serious or edge case issues (e.g. queries about compatibility with optional RFC specifications) can be raised as public issues on GitHub. | ||
|
|
||
| If you discover what you think may be a potentially serious security problem, please contact a core team member via a private channel (e.g. via email to [email protected]) or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details. | ||
| If you discover what you think may be a potentially serious security problem, please contact a core team member via a private channel (e.g. via email to [email protected] or [email protected] and [email protected]) or raise a public issue requesting someone get in touch with you via whatever means you prefer for more details. | ||
|
|
||
| ### What is the disclosure policy for NextAuth.js? | ||
|
|
||
|
|
@@ -165,60 +161,60 @@ Ultimately if your request is not accepted or is not actively in development, yo | |
|
|
||
| --- | ||
|
|
||
| ## JSON Web Tokens | ||
| ## JSON Web Tokens | ||
|
|
||
| ### Does NextAuth.js use JSON Web Tokens? | ||
|
|
||
| NextAuth.js supports both database session tokens and JWT session tokens. | ||
|
|
||
| * If a database is specified, database session tokens will be used by default. | ||
| * If no database is specified, JWT session tokens will be used by default. | ||
| - If a database is specified, database session tokens will be used by default. | ||
| - If no database is specified, JWT session tokens will be used by default. | ||
|
|
||
| You can also choose to use JSON Web Tokens as session tokens with using a database, by explicitly setting the `session: { jwt: true }` option. | ||
|
|
||
| ### What are the advantages of JSON Web Tokens? | ||
|
|
||
| JSON Web Tokens can be used for session tokens, but are also used for lots of other things, such as sending signed objects between services in authentication flows. | ||
|
|
||
| * Advantages of using a JWT as a session token include that they do not require a database to store sessions, this can be faster and cheaper to run and easier to scale. | ||
| - Advantages of using a JWT as a session token include that they do not require a database to store sessions, this can be faster and cheaper to run and easier to scale. | ||
|
|
||
| * JSON Web Tokens in NextAuth.js are secured using cryptographic signing (JWS) by default and it is easy for services and API endpoints to verify tokens without having to contact a database to verify them. | ||
| - JSON Web Tokens in NextAuth.js are secured using cryptographic signing (JWS) by default and it is easy for services and API endpoints to verify tokens without having to contact a database to verify them. | ||
|
|
||
| * You can enable encryption (JWE) to store include information directly in a JWT session token that you wish to keep secret and use the token to pass information between services / APIs on the same domain. | ||
| - You can enable encryption (JWE) to store include information directly in a JWT session token that you wish to keep secret and use the token to pass information between services / APIs on the same domain. | ||
|
|
||
| * You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site. | ||
| - You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only-token so data in the JWT is not accessible to third party JavaScript running on your site. | ||
|
|
||
| ### What are the disadvantages of JSON Web Tokens? | ||
|
|
||
| * You cannot as easily expire a JSON Web Token - doing so requires maintaining a server side blocklist of invalid tokens (at least until they expire) and checking every token against the list every time a token is presented. | ||
| - You cannot as easily expire a JSON Web Token - doing so requires maintaining a server side blocklist of invalid tokens (at least until they expire) and checking every token against the list every time a token is presented. | ||
|
|
||
| Shorter session expiry times are used when using JSON Web Tokens as session tokens to allow sessions to be invalidated sooner and simplify this problem. | ||
|
|
||
| NextAuth.js client includes advanced features to mitigate the downsides of using shorter session expiry times on the user experience, including automatic session token rotation, optionally sending keep alive messages to prevent short lived sessions from expiring if there is an window or tab open, background re-validation, and automatic tab/window syncing that keeps sessions in sync across windows any time session state changes or a window or tab gains or loses focus. | ||
|
|
||
| * As with database session tokens, JSON Web Tokens are limited in the amount of data you can store in them. There is typically a limit of around 4096 bytes per cookie, though the exact limit varies between browsers, proxies and hosting services. If you want to support most browsers, then do not exceed 4096 bytes per cookie. If you want to save more data, you will need to persist your sessions in a database (Source: [browsercookielimits.iain.guru](http://browsercookielimits.iain.guru/)) | ||
| - As with database session tokens, JSON Web Tokens are limited in the amount of data you can store in them. There is typically a limit of around 4096 bytes per cookie, though the exact limit varies between browsers, proxies and hosting services. If you want to support most browsers, then do not exceed 4096 bytes per cookie. If you want to save more data, you will need to persist your sessions in a database (Source: [browsercookielimits.iain.guru](http://browsercookielimits.iain.guru/)) | ||
|
|
||
| The more data you try to store in a token and the more other cookies you set, the closer you will come to this limit. If you wish to store more than ~4 KB of data you're probably at the point where you need to store a unique ID in the token and persist the data elsewhere (e.g. in a server-side key/value store). | ||
|
|
||
| * Data stored in an encrypted JSON Web Token (JWE) may be compromised at some point. | ||
| - Data stored in an encrypted JSON Web Token (JWE) may be compromised at some point. | ||
|
|
||
| Even if appropriately configured, information stored in an encrypted JWT should not be assumed to be impossible to decrypt at some point - e.g. due to the discovery of a defect or advances in technology. | ||
|
|
||
| Avoid storing any data in a token that might be problematic if it were to be decrypted in the future. | ||
|
|
||
| * If you do not explicitly specify a secret for NextAuth.js, existing sessions will be invalidated any time your NextAuth.js configuration changes, as NextAuth.js will default to an auto-generated secret. | ||
| - If you do not explicitly specify a secret for NextAuth.js, existing sessions will be invalidated any time your NextAuth.js configuration changes, as NextAuth.js will default to an auto-generated secret. | ||
|
|
||
| If using JSON Web Token you should at least specify a secret and ideally configure public/private keys. | ||
|
|
||
| ### Are JSON Web Tokens secure? | ||
|
|
||
| By default tokens are signed (JWS) but not encrypted (JWE), as encryption adds additional overhead and reduces the amount of space available to store data (total cookie size for a domain is limited to 4KB). | ||
|
|
||
| * JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key. | ||
| - JSON Web Tokens in NextAuth.js use JWS and are signed using HS512 with an auto-generated key. | ||
|
|
||
| * If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key. | ||
| - If encryption is enabled by setting `jwt: { encryption: true }` option then the JWT will _also_ use JWE to encrypt the token, using A256GCM with an auto-generated key. | ||
|
|
||
| You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption). | ||
| You can specify other valid algorithms - [as specified in RFC 7518](https://tools.ietf.org/html/rfc7517) - with either a secret (for symmetric encryption) or a public/private key pair (for a symmetric encryption). | ||
|
|
||
| NextAuth.js will generate keys for you, but this will generate a warning at start up. | ||
|
|
||
|
|
@@ -228,14 +224,14 @@ Using explicit public/private keys for signing is strongly recommended. | |
|
|
||
| NextAuth.js includes a largely complete implementation of JSON Object Signing and Encryption (JOSE): | ||
|
|
||
| * [RFC 7515 - JSON Web Signature (JWS)](https://tools.ietf.org/html/rfc7515) | ||
| * [RFC 7516 - JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516) | ||
| * [RFC 7517 - JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) | ||
| * [RFC 7518 - JSON Web Algorithms (JWA)](https://tools.ietf.org/html/rfc7518) | ||
| * [RFC 7519 - JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519) | ||
| - [RFC 7515 - JSON Web Signature (JWS)](https://tools.ietf.org/html/rfc7515) | ||
| - [RFC 7516 - JSON Web Encryption (JWE)](https://tools.ietf.org/html/rfc7516) | ||
| - [RFC 7517 - JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) | ||
| - [RFC 7518 - JSON Web Algorithms (JWA)](https://tools.ietf.org/html/rfc7518) | ||
| - [RFC 7519 - JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519) | ||
|
|
||
| This incorporates support for: | ||
|
|
||
| * [RFC 7638 - JSON Web Key Thumbprint](https://tools.ietf.org/html/rfc7638) | ||
| * [RFC 7787 - JSON JWS Unencoded Payload Option](https://tools.ietf.org/html/rfc7797) | ||
| * [RFC 8037 - CFRG Elliptic Curve ECDH and Signatures](https://tools.ietf.org/html/rfc8037) | ||
| - [RFC 7638 - JSON Web Key Thumbprint](https://tools.ietf.org/html/rfc7638) | ||
| - [RFC 7787 - JSON JWS Unencoded Payload Option](https://tools.ietf.org/html/rfc7797) | ||
| - [RFC 8037 - CFRG Elliptic Curve ECDH and Signatures](https://tools.ietf.org/html/rfc8037) | ||