Zum Hauptinhalt springen

Identität & Zugriff

Authentifizierung, Autorisierung und Benutzerverwaltung — sandboxed, fixture-basiert, ohne echte Zugangsdaten.

How users prove who they are — passwordless magic links, email OTP, and OAuth. Everything below is sandboxed: no real credentials, no network, no account created.

Sign in (sandbox)

Sandbox
How this works

This form is visually identical to the real one but runs entirely in the browser: no authClient call, no network request, no account created. The whole Identity & Access showcase has zero server code, so it physically cannot leak a session.

Sign-in flow (recorded)

Recorded
  1. 1User submits email → POST /api/auth/sign-in/{magic-link|email-otp}
  2. 2ALTCHA captcha gate verifies the token (authCaptchaGate, before Better Auth)
  3. 3Per-email + per-IP (Upstash) rate limits checked
  4. 4Better Auth issues a short-lived token (300s) and sends it via Resend
  5. 5User returns with the token → session row created (7-day expiry)
  6. 6sessionPopulate resolves the cookie into locals.user / locals.session

Verification rows are TTL-governed: e.g. demo_vrf_fresh expires at 2026-05-19T09:05:00.000Z — value column is «never selected» (never selected).

Request middleware order (recorded)

Recorded

The exact sequence(...) order from hooks.server.ts, auth-relevant handlers highlighted.

  1. 1 securityHeaders Stamps x-client-ip + security headers auth
  2. 2 stripBaseLocalePrefix i18n path normalization
  3. 3 loadStyle Resolves the active style
  4. 4 i18n Locale detection
  5. 5 authCaptchaGate ALTCHA gate on auth send endpoints auth
  6. 6 authHandler Better Auth svelteKitHandler (does NOT populate locals) auth
  7. 7 sessionPopulate Reads cookie → locals.user / locals.session auth
  8. 8 csrfProtection x-requested-with + same-origin on JSON mutations auth
  9. 9 consentLoader Analytics consent tier
  10. 10 debugOwnerLoader Optional HMAC debug pairing
  11. 11 devRouteGuard Hides dev routes outside dev
  12. 12 analyticsCollector Event collection

Geht dieses Pattern noch besser? Sag uns, wie.

Feedback geben