Configuration

Configuration options for FortressAuth.

Full Configuration Example

import { FortressAuth } from '@fortressauth/core';

const fortress = new FortressAuth(repository, rateLimiter, emailProvider, {
  // Session configuration
  session: {
    ttlMs: 7 * 24 * 60 * 60 * 1000, // 7 days (default)
  },
  
  // Password requirements
  password: {
    minLength: 8,      // default: 8
    maxLength: 128,    // default: 128
    breachedCheck: {
      enabled: false,  // default: false
      threshold: 1,    // reject if found this many times
    },
  },
  
  // Email verification
  emailVerification: {
    ttlMs: 24 * 60 * 60 * 1000, // 24 hours (default)
  },
  
  // Password reset
  passwordReset: {
    ttlMs: 60 * 60 * 1000,     // 1 hour (default)
    maxActiveTokens: 3,        // max active tokens per user
  },
  
  // Account lockout
  lockout: {
    enabled: true,             // default: true
    maxFailedAttempts: 5,      // default: 5
    lockoutDurationMs: 15 * 60 * 1000, // 15 minutes (default)
  },
  
  // Rate limiting
  rateLimit: {
    enabled: true,             // default: true
    endpoints: {
      login: { maxAttempts: 5, windowMs: 60000 },
      signup: { maxAttempts: 3, windowMs: 60000 },
      passwordReset: { maxAttempts: 3, windowMs: 60000 },
      verifyEmail: { maxAttempts: 5, windowMs: 60000 },
    },
  },
  
  // URLs for email links
  urls: {
    baseUrl: 'https://yourdomain.com',
  },
});

Configuration Options

Session Configuration

Option	Type	Default	Description
`session.ttlMs`	`number`	604800000 (7 days)	Session token time-to-live in milliseconds

Password Configuration

Option	Type	Default	Description
`password.minLength`	`number`	8	Minimum password length
`password.maxLength`	`number`	128	Maximum password length
`password.breachedCheck.enabled`	`boolean`	false	Check passwords against Have I Been Pwned
`password.breachedCheck.threshold`	`number`	1	Reject if password found this many times in breaches

Email Verification Configuration

Option	Type	Default	Description
`emailVerification.ttlMs`	`number`	86400000 (24 hours)	Email verification token TTL

Password Reset Configuration

Option	Type	Default	Description
`passwordReset.ttlMs`	`number`	3600000 (1 hour)	Password reset token TTL
`passwordReset.maxActiveTokens`	`number`	3	Maximum active reset tokens per user

Lockout Configuration

Option	Type	Default	Description
`lockout.enabled`	`boolean`	true	Enable account lockout after failed attempts
`lockout.maxFailedAttempts`	`number`	5	Failed attempts before lockout
`lockout.lockoutDurationMs`	`number`	900000 (15 min)	Lockout duration in milliseconds

Rate Limit Configuration

Option	Type	Default	Description
`rateLimit.enabled`	`boolean`	true	Enable rate limiting
`rateLimit.endpoints.login`	`object`	-	Rate limit config for login endpoint
`rateLimit.endpoints.signup`	`object`	-	Rate limit config for signup endpoint

URL Configuration

Option	Type	Default	Description
`urls.baseUrl`	`string`	http://localhost:3000	Base URL for email links

Environment Variables

When using the HTTP server package, configuration can be set via environment variables:

# Server
PORT=5000
HOST=0.0.0.0
NODE_ENV=production

# Database
DATABASE_URL=postgresql://user:pass@localhost:5432/auth

# URLs
BASE_URL=https://yourdomain.com
CORS_ORIGINS=https://yourdomain.com,https://app.yourdomain.com

# Email (Resend)
EMAIL_PROVIDER=resend
RESEND_API_KEY=re_xxxxx
EMAIL_FROM_ADDRESS=noreply@yourdomain.com
EMAIL_FROM_NAME=Your App

# Session
SESSION_TTL_MS=604800000

# Password
PASSWORD_MIN_LENGTH=8
PASSWORD_MAX_LENGTH=128
BREACHED_PASSWORD_CHECK=false

# Lockout
LOCKOUT_ENABLED=true
LOCKOUT_MAX_ATTEMPTS=5
LOCKOUT_DURATION_MS=900000

# Rate Limiting
RATE_LIMIT_ENABLED=true

TypeScript Types

import type { FortressConfig, FortressConfigInput } from '@fortressauth/core';

// FortressConfigInput - what you pass to the constructor
// FortressConfig - the resolved config with all defaults applied