Security
Auth7 implements several security practices.
Token Rotation
Refresh tokens rotate on every request.
Password Hashing
Passwords are securely hashed using bcrypt.
Cookie Security
Auth7 uses HTTP-only cookies to prevent XSS attacks.
Rate Limiting
Login and register endpoints include rate limiting to prevent brute-force attacks.
Session Invalidation
Password reset automatically invalidates existing sessions.