// the find
atinux/nuxt-auth-utils
Add Authentication to Nuxt applications with secured & sealed cookies sessions.
A Nuxt module that adds cookie-session-based authentication with OAuth, passkeys, and password hashing. It's a practical, batteries-included starting point for Nuxt SSR apps that need auth without pulling in NextAuth or rolling their own. The target is Nuxt developers who want something that works in under 10 minutes.
Forty-plus OAuth providers with a consistent `defineOAuth<Provider>EventHandler` pattern means adding a new provider is mechanical, not a research project. The sealed-cookie approach (via h3's session utilities) means there's no server-side session store to manage for simple use cases. WebAuthn support is first-class and the playground includes working register/authenticate flows, which is rare for a module this small. The `loadStrategy` option and `<AuthState>` component actually solve the SSR hydration flash problem that most auth implementations just ignore.
WebAuthn challenge storage is opt-in and the README explicitly warns that the default skips it — shipping passkeys without challenges defeats much of the security point, and that's a bad default for people copy-pasting the example. The 4096-byte cookie ceiling is a hard wall that bites you the moment you store anything beyond a user ID and timestamp; there's no built-in fallback to a server-side store. Session refresh/rotation on access is not covered — a stolen cookie is valid for the full `maxAge` with no mechanism to invalidate it short of changing `NUXT_SESSION_PASSWORD` (which invalidates everyone). JWT support appears only in the playground, not the module itself, so the README's implication that it's a feature is misleading.