// the find
flaviuse/mern-authentication
MERN stack authentication boilerplate: password reset, email verification, server sessions, redux, typescript, hooks and docker for dev and prod.
A MERN stack auth boilerplate covering the full flow: registration, email verification, password reset, and server-side sessions. TypeScript throughout both client and server, with Docker configurations for dev (hot reload) and prod (nginx serving static files). Targets developers who want a working starting point rather than wiring all this up themselves.
Server-side sessions instead of JWTs is the right call for most web apps — easier to invalidate on logout, and this repo actually implements it correctly with a session model in MongoDB rather than bolting it on as an afterthought. The Docker setup covers both environments properly: hot reloading in dev, nginx-served static build in prod, separate env files for each stage. Playwright e2e tests and GitHub Actions CI (CodeQL + docker-prod smoke test) are present and wired up, which is rare for a boilerplate at this star count. Token-based email verification with resend and password reset is a complete implementation, not a stub.
It's almost certainly still on Create React App, which has been unmaintained for years — the directory structure and the CRA-specific `react-app-env.d.ts` file confirm it. Migrating a new project off CRA to Vite is friction you shouldn't inherit from a boilerplate. Classic Redux with hand-written actions, reducers, and thunks for auth state is a lot of ceremony; Redux Toolkit would cut this in half, and React Query or Zustand would likely be a better fit for auth state specifically. SendGrid is hardcoded as the only email provider with no abstraction layer, so swapping to Resend or SES means touching the email service internals rather than flipping a config. The README openly notes that verification links are sent over HTTP by default and tells you to change it yourself — that's a foot-gun that should be opt-out, not opt-in.