Security Overview

Security features and best practices for Nuxt Aegis.

Security Features

Nuxt Aegis implements multiple security layers to protect your authentication system.

OAuth 2.0 + Authorization CODE Flow

✅ Authorization CODE Flow - Additional security layer with short-lived CODEs
✅ Single-Use CODEs - CODEs deleted immediately after exchange
✅ 60-Second Expiration - CODEs expire quickly to minimize attack window
✅ No Token Exposure - Access tokens never appear in URLs or browser history

Learn more about Authorization CODE Flow →

OAuth Callback Correlation

All shared OAuth handlers, including Mock, generate independent 32-byte random state and initiator proof values. The server stores only the proof hash. Callbacks must match the state, proof cookie, provider, client ID, redirect URI, and ten-minute expiry before token exchange or authentication hooks run. Successful verification atomically consumes the transaction, including on provider denial; an exchange failure requires a fresh login. Invalid proofs do not consume a valid transaction.

Legacy callbacks without a pending transaction are rejected. Caller-supplied state is metadata, not security proof, and cannot override generated state Initial redirectTo must be an application-local path and is restored only from server storage, never from callback query parameters.

This release supports single-process memory transactions only, not shared or serverless OAuth deployments. See OAuth transaction storage.

PKCE and cookie-free CLI OAuth login remain deferred. Bearer JWT requests after login remain independent of the proof cookie.

JWT Token Security

✅ Short-Lived Tokens - 1-hour expiration (configurable)
✅ Cryptographic Signing - HS256/RS256 algorithms
✅ Custom Claims Validation - Automatic filtering of reserved claims
✅ Token Refresh - Seamless token renewal without re-authentication

Learn more about Token Refresh →

Refresh Token Security

✅ Server-Side Storage - Refresh tokens never sent to client
✅ HttpOnly Cookies - Not accessible to JavaScript
✅ Encryption at Rest - AES-256-GCM for sensitive data
✅ Token Revocation - Immediate invalidation on logout

Configure Storage →

✅ HttpOnly Flag - Prevents XSS attacks
✅ Secure Flag - HTTPS-only transmission
✅ SameSite Protection - CSRF attack prevention
✅ Path Restriction - Limited cookie scope

Data Encryption

✅ AES-256-GCM - Industry-standard authenticated encryption
✅ Random IVs - Unique initialization vector for each encryption
✅ Authentication Tags - Tamper detection
✅ Key Rotation - Support for encryption key updates

Configure Encryption →

Security Best Practices

Detailed security recommendations and implementation guides.

View Security Best Practices →

Threat Protection

Protected Against

Threat	Protection Mechanism
XSS	HttpOnly cookies, CSP headers
OAuth Login CSRF	Random state plus independent initiator proof, atomic context-bound consumption
Token Theft	Short-lived tokens, HTTPS-only
Replay Attacks	Single-use CODEs, token expiration
Session Hijacking	Secure cookies, token rotation
Man-in-the-Middle	HTTPS enforcement, secure cookies

Security Headers

Recommended security headers for production:

typescript

// nuxt.config.ts
export default defineNuxtConfig({
  nitro: {
    routeRules: {
      '/**': {
        headers: {
          'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
          'X-Content-Type-Options': 'nosniff',
          'X-Frame-Options': 'DENY',
          'X-XSS-Protection': '1; mode=block',
          'Referrer-Policy': 'strict-origin-when-cross-origin',
        },
      },
    },
  },
})

Compliance

✅ User data encryption at rest
✅ Explicit consent through OAuth
✅ Data minimization (only necessary claims)
✅ Right to be forgotten (logout/token revocation)

OWASP Top 10

Nuxt Aegis addresses key OWASP vulnerabilities:

✅ A01:2021 – Broken Access Control - Route protection, RBAC
✅ A02:2021 – Cryptographic Failures - AES-256-GCM encryption
✅ A07:2021 – Identification and Authentication Failures - OAuth 2.0, JWT

Security Checklist

Production Security Checklist

Required for Production

[ ] Set strong NUXT_AEGIS_TOKEN_SECRET (32+ characters)
[ ] Enable HTTPS (secure: true in cookies)
[ ] Keep OAuth initiation/callback in one long-lived process; shared deployments are unsupported
[ ] Trust forwarded protocol only behind an exclusive, header-sanitizing proxy
[ ] Use Redis for refresh token storage (not filesystem)
[ ] Enable encryption at rest
[ ] Set NODE_ENV=production
[ ] Never use Mock provider in production
[ ] Configure secure CORS policies
[ ] Implement rate limiting
[ ] Set up security headers
[ ] Regular security audits

Reporting Security Issues

Security Vulnerability Disclosure

If you discover a security vulnerability in Nuxt Aegis:

DO NOT open a public GitHub issue
Email security concerns to the maintainers
Provide detailed reproduction steps
Allow time for patch development
Coordinate disclosure timeline

Security Overview ​

Security Features ​

OAuth 2.0 + Authorization CODE Flow ​

OAuth Callback Correlation ​

JWT Token Security ​

Refresh Token Security ​

Cookie Security ​

Data Encryption ​

Security Best Practices ​

Threat Protection ​

Protected Against ​

Security Headers ​

Compliance ​

GDPR Compliance ​

OWASP Top 10 ​

Security Checklist ​

Required for Production ​

Recommended ​

Reporting Security Issues ​

Related ​