Clerk

Promptfree, for everyone, and the only version there is

Open the prompt in Claude CodeOpen the prompt in CodexOpen the prompt in Cursor

Copy

Build me session-based authentication for one application, using a maintained library for the cryptography.

STACK
- Astro with a Node adapter, SQLite via better-sqlite3
- A maintained password hashing library — argon2id — and a maintained session library; write neither yourself

SESSIONS, NOT TOKENS
- Opaque session id in an httpOnly, Secure, SameSite=Lax cookie
- Server-side session table with user id, created time, last seen, IP hash and user agent bucket
- Rotate the id on privilege change; expire absolutely at 30 days and idly at 14

PASSWORDS
- argon2id with parameters written in the README and reviewed yearly
- Check new passwords against the Have I Been Pwned range API using k-anonymity, never sending the password
- Never limit length below 64 characters, and never strip characters

EMAIL VERIFICATION AND RESET
- Single-use tokens, hashed in the database, expiring in 30 minutes
- A reset always reports the same message whether or not the address exists
- Resetting invalidates every existing session

RATE LIMITING
- Per address and per IP hash, with exponential backoff and a lockout that unlocks by email

WHAT IS OUT OF SCOPE
- Social login, passkeys, SAML, organisations — each is its own project, and the README should say so

Include a README on the hashing parameters, the session lifetimes and the incident plan if the table leaks.