Skip to content

Releases: MRJonam91/ZeroAuth

Release list

v1.0.0 - ZeroAuth General Availability

v1.0.0 - ZeroAuth General Availability Latest
Latest

Choose a tag to compare

View all tags
@MRJonam91 MRJonam91 released this 26 Sep 10:05
v1.0.0
a165178

🚀 ZeroAuth v1.0.0 — Stable General Availability (GA)

ZeroAuth is a lightweight, zero-dependency, self-hosted Passkeys & WebAuthn authentication engine designed for modern web apps, indie hackers, and privacy-first architectures.

🌟 What's New in v1.0.0

  • 🧩 Zero-Dependency Core (@zeroauth/core): Under 1,000 LOC, standalone zero-dependency CBOR decoder, COSE/WebCrypto validator (ES256, Ed25519), and AAGUID hardware identification (Apple TouchID/FaceID, Windows Hello, YubiKey, Google Titan).
  • 🛡️ Enterprise Security & Universal Server (@zeroauth/server): Built-in anti-phishing origin checks, anti-replay challenge verification, cloned authenticator detection via signature counters, in-memory sliding sessions, and token-bucket rate limiting.
  • 🔌 Pluggable Storage Adapters: Native SQLite via
    ode:sqlite\ (zero native compilation required) and PostgreSQL adapter for distributed production setups.
  • 🌐 Universal Web Handler: One-line handler (\createZeroAuthHandler) conforming to Web Standards (\Request\ / \Response), compatible with Next.js (App Router), Remix, Astro, SvelteKit, Express, and Fastify.
  • ⚛️ Modern React SDK (@zeroauth/react): Ready-to-use hooks (\usePasskey, \useZeroAuth) and plug-and-play UI components (<PasskeyButton>, <PasskeyList>).
  • 🎮 Standalone Demo App: Runnable live sandbox demonstrating multi-passkey registration, cross-device authentication, renaming, and credential revocation.
  • 📖 Bilingual Documentation: Full documentation and quickstarts available in both English and Italian.

📦 Packages Included

  • @zeroauth/core@1.0.0\
  • @zeroauth/server@1.0.0\
  • @zeroauth/client@1.0.0\
  • @zeroauth/react@1.0.0\

🤝 Sponsorship & Commercial Licensing

ZeroAuth is dual-licensed under GNU AGPLv3 (for open source projects) and a Commercial License (for proprietary/closed-source SaaS products or IP acquisition).

Support ongoing development:

Assets 2
Loading

v0.3.0 Beta - Multi-Passkey Management, AAGUID Resolver, Postgres & React UI

v0.3.0 Beta - Multi-Passkey Management, AAGUID Resolver, Postgres & React UI

Choose a tag to compare

View all tags
@MRJonam91 MRJonam91 released this 26 Sep 09:49
v0.3.0-beta
c56154d

🚀 ZeroAuth v0.3.0 Beta Release

We are excited to announce ZeroAuth v0.3.0 Beta! This milestone delivers production-readiness with multi-device passkey backup management, hardware AAGUID model resolution, a production PostgreSQL adapter, sliding-window rate limiting, and ready-to-use React UI components.

✨ What's New in Beta

  1. 🔑 Multi-Passkey Management:

    • Register multiple backup passkeys per user account (e.g. MacBook Touch ID, iPhone Face ID, YubiKey 5 NFC).
    • Dedicated REST API routes: \GET /credentials, \PATCH /credentials\ (rename key), and \DELETE /credentials\ (revoke key).

  2. 🏷️ AAGUID Hardware Model Resolution:

    • Automatic identification of hardware authenticators: Apple iCloud Keychain, Touch ID / Face ID, Windows Hello, YubiKey 5 Series, and Google Password Manager.

  3. 🛡️ Built-in Rate Limiter (Anti-Abuse / DoS Mitigation):

    • Sliding-window rate limiter protecting challenge generation endpoints against brute-force attacks and resource exhaustion.

  4. 🐘 PostgreSQL Storage Adapter (\PostgresStorageAdapter):

    • Production SQL driver compatible with standard PostgreSQL, Supabase, Neon, and Vercel Postgres, complete with standard DDL in \docs/postgres-schema.sql.

  5. ⚛️ Pre-built React UI Components:

    • <PasskeyButton>: biometric styled button with customizable variants.
    • <PasskeyList>: full interactive passkey management list supporting renaming and revocation.

  6. 🧪 26 Automated Tests (100% Pass Rate):

    • Coverage for CBOR edge-cases, AAGUID resolution, multi-credential workflows, rate limiting, anti-phishing, anti-replay, and clone detection.

  7. 🪶 Ultra-compact Core Compliance:

    • @zeroauth/core\ remains at only 833 LOC, strictly adhering to the < 1,500 LOC rule for zero-bloat transparency.

💖 Support the Project

ZeroAuth is 100% free and open-source under a Dual-Licensing model.
If it saves your project expensive Auth0 / Clerk fees, support ongoing development:

💼 Commercial Licensing & Project Buyout

Distributed under GNU AGPLv3 with Commercial Proprietary Licensing available for closed-source SaaS applications and full IP acquisition: https://github.com/MRJonam91

Loading

v0.2.0 Alpha - Universal Handler, Sessions, React Provider & Security Suite

v0.2.0 Alpha - Universal Handler, Sessions, React Provider & Security Suite

Choose a tag to compare

View all tags
@MRJonam91 MRJonam91 released this 25 Sep 22:23
v0.2.0-alpha
a51cf7a

🌟 ZeroAuth v0.2.0 Alpha Release

We are proud to release ZeroAuth v0.2.0 Alpha, bringing the self-hosted Passkeys & WebAuthn engine to full framework readiness with sessions, universal HTTP routing, and complete React state management!

🚀 What's New in Alpha

  1. 🌐 Universal Web Standard Handler (\createZeroAuthHandler):

    • Zero-boilerplate integration with Next.js App Router, Hono, SvelteKit, Astro, Bun, and Node.js.
    • Built on standard Fetch API \Request\ -> \Response\ with automatic cookie handling.

  2. 🔐 Cryptographic Session Manager (\SessionManager):

    • Secure opaque session tokens with sliding expiration and persistent storage across SQLite and In-Memory adapters.
    • Automatic revocation on logout and automated session pruning.

  3. ⚛️ Full React Authentication Provider (<ZeroAuthProvider>\ & \useZeroAuth()):

    • Centralized authentication context in @zeroauth/react\ providing global reactive \user, \isAuthenticated, \login(),
      egister(), and \logout().

  4. 🛡️ Standardized Client Errors (\ZeroAuthClientError):

    • Normalized browser DOMExceptions to friendly error codes (\USER_CANCELLED, \TIMEOUT, \NOT_SUPPORTED, \INVALID_STATE).

  5. 🧪 Comprehensive Security & Edge Case Test Suite:

    • 20 unit and integration tests passing with 100% success rate:
      • Anti-Phishing origin validation
      • Anti-Replay challenge binding
      • Cloned authenticator detection via counter validation
      • CBOR decoding boundary and truncation resilience

  6. 🪶 Ultra-compact Core:

    • Maintained under the strict < 1,500 LOC rule (@zeroauth/core\ at only 738 LOC) with zero external dependencies.

💖 Support Ongoing Development

ZeroAuth is built for indie hackers, developers, and open-source advocates.
Support the project:

💼 Commercial Licensing & IP Acquisition

Dual-licensed under GNU AGPLv3 and Commercial Proprietary License. For proprietary SaaS, enterprise licensing, or full IP acquisition inquiries: https://github.com/MRJonam91

Loading

v0.1.0 MVP - First Functional WebAuthn & Passkeys Engine

v0.1.0 MVP - First Functional WebAuthn & Passkeys Engine

Choose a tag to compare

View all tags
@MRJonam91 MRJonam91 released this 25 Sep 22:18
v0.1.0-mvp
3a4d614

🚀 ZeroAuth v0.1.0 MVP: Self-Hosted Passkeys & WebAuthn Engine

We are excited to announce the first functional MVP of ZeroAuth — a modern, self-hosted, decentralized authentication suite powered by standard W3C WebAuthn Level 3 and hardware Passkeys (Touch ID, Face ID, Windows Hello, YubiKey).

✨ MVP Highlights

  • 🪶 Core < 1,500 LOC (732 LOC achieved): Ultra-compact, dependency-free cryptographic engine in pure TypeScript.
  • 📦 Embedded CBOR & COSE Decoder: RFC 8949 compliant binary decoder (< 150 LOC) parsing \�ttestationObject\ and COSE public keys without external bloatware.
  • 🔐 WebCrypto Native: Standard cryptographic operations (\crypto.subtle) for SHA-256 digests, ASN.1 DER to IEEE P1363 signature conversions, and ECDSA P-256 / Ed25519 signature validations.
  • 🗄️ Zero-Config SQLite Adapter: Integrated \SqliteStorageAdapter\ utilizing Node.js 22/24 native
    ode:sqlite\ (no native compilation required).
  • 🎮 Interactive Standalone Demo: Complete runnable demo in \examples/standalone-demo\ to test biometric registration and login in your browser.
  • 🛡️ Steganographic Provenance: Embedded cryptographic watermarks for author attribution and IP verification.

🏃 Quickstart: Run the Interactive Demo

\\�ash
git clone https://github.com/MRJonam91/ZeroAuth.git
cd ZeroAuth
npm install
npm run build
node examples/standalone-demo/server.mjs
\\

Open \http://localhost:3000\ in your browser to create and test hardware Passkeys!

💖 Support & Donations

If ZeroAuth helps you save hundreds of dollars on Auth0 or Clerk bills, please support ongoing maintenance:

💼 Commercial Licensing & IP Acquisition

ZeroAuth is distributed under a Dual-Licensing model (GNU AGPLv3 + Commercial License).

  • Free for open-source projects complying with AGPLv3.
  • Commercial proprietary licenses available for closed-source SaaS products, enterprise distributions, or full project acquisition.
  • Contact: https://github.com/MRJonam91
Loading