#authentication

Building SaaS Auth from Scratch

Authentication is the foundation of any SaaS application. In this post, we'll walk through how AtendePraMim implements session-based auth with iron-session, 2FA via TOTP, and magic links. We use iron-session with AES-256 encrypted HttpOnly cookies. No JWTs exposed to the browser. TOTP-based 2FA adds a second layer. The user scans a QR code with their…