TOGO
togo
Pages · togo

Authentication & authorization

togo-framework/auth is the security boundary (enterprise-hardened; scanned with govulncheck + gosec).

  • Login/JWT — HS256, expiry-required, issuer-pinned; bcrypt passwords.
  • Sessions — SESSION_DRIVER = cookie (stateless) | database | file | redis. Revocable.
  • RBAC — roles + permissions; RequireRole / RequirePermission middleware; multi-guard.
  • MFA — OTP (email via events), TOTP 2FA (RFC 6238), PIN lock screen.
  • API tokens — scoped abilities (Sanctum/Cloudflare-style): POST /api/auth/tokens.
  • Security — CSRF (double-submit), CORS allowlist, per-IP rate limiting, HttpOnly+SameSite cookies.
  • Drivers — Supabase/GoTrue, OAuth (Google/GitHub/Facebook), Firebase, WorkOS SSO.
  • UI — togo-framework/dashboard injects login/register/reset/2fa/pin/lock/profile/dashboard (i18n).
go