epic-auth

Least privilege - Users should only have access to what they need, when they need it. Sessions should have minimal permissions and expire appropriately. Don't grant more access than necessary.

Design to fail fast and early - Validate authentication and authorization as early as possible. Check session validity immediately, verify permissions before processing requests, and return clear errors quickly.

Epic Stack uses cookie-based sessions for authentication. Sessions are stored in the database and identified by signed cookies.

دليل حول المصادقة والجلسات وOAuth و2FA ومفاتيح المرور لـ Epic Stack المصدر: epicweb-dev/epic-stack.