A lightweight and developer-friendly npm package designed to detect and prevent session hijacking in modern web applications, including Next.js, serverless, and edge environments.

Core Concept

• Binds authentication tokens to a unique browser/device fingerprint

• Detects token reuse from different devices instantly

• Flags suspicious activity in real time to prevent unauthorized access

Key Features

• Session hijacking detection using fingerprint validation

• Secure SHA-256–based browser/device fingerprinting

• Redis-backed session storage (Upstash, ioredis, node-redis supported)

• JWT-based authentication with replay attack protection

• Built-in email alert system for suspicious login detection

• Lightweight, dependency-free core

Available Functions

1. generateFingerprint()

• Generates a unique device fingerprint

• Uses browser signals like OS, hardware, canvas, etc.

• Returns:

  • id (SHA-256 hash)

  • raw components

  • algorithm version

  • timestamp

• Used on the client side

2. addSession(authTokenHash, fingerprint, redis)

• Stores a mapping of token → fingerprint in Redis

• Called during user login

• Ensures session is bound to a specific device

3. verifySession(authTokenHash, fingerprint, redis)

• Validates if the current fingerprint matches the stored one

• Detects session hijacking attempts

• Returns:

  • valid → session is safe

  • hijacked → possible attack detected

  • receivedFingerprint → stored value (for debugging)

• Used on every protected request

4. generateAuthToken(jwtSecret, options)

• Generates a secure JWT authentication token

• Includes a unique nonce to prevent replay attacks

• Configurable:

  • payload (user data)

  • expiration time

  • algorithm (default: HS256)

5. email(service, senderEmail, senderAppPassword, receiverEmail)

• Sends a security alert email

• Notifies users of potential session compromise

• Supports providers like Gmail, Outlook, Yahoo etc.