/technology/modules/ · auth-password Shipping
auth-password
Email and password. The oldest login method, and the only one where a stranger can simply keep guessing.
What it is
auth-password.
Register, log in, change a password. Most of the crate is about the part that makes this method different from every other one here: a stranger can sit and guess, so registration and login answer the same way whatever the account state, and the lockout columns live on the credential rather than in a cache that forgets.
It requires the paid Workers plan, and that is a measurement rather than a preference. ADR 0200 timed Argon2id at the parameters this uses (m=19456, t=2, p=1) at roughly 40 ms per hash or verify on Workers. The free tier allows 10 ms of CPU, which cannot fit one verify at any sane parameters. Weakening the parameters to fit is the trade this crate refuses to make.
Crate
factory0-auth-password · in the repo, not yet on crates.io. MIT.
Ports
Database · Clock · IdGen · RateLimiter, Captcha and HttpClient optional
Routes
POST /v1/auth-password/register— always 202, always the same bodyPOST /v1/auth-password/login— a session cookie, or one refusalPOST /v1/auth-password/change— current and new, for somebody signed in
The breach check
The optional HttpClient is for one thing: telling somebody their new password is already in a public breach corpus. Without it the module runs; the check is the part a deployment can decline.
Tables
None of its own. auth-core owns every table it touches, including the lockout columns on credentials.
A password is the method a passkey exists to replace. Both are here.