Tutorial: Secure Auth with XEMS

This tutorial details the implementation of advanced authentication systems using the XyPriss Encrypted Memory Store (XEMS). Learn how to leverage native isolation and atomic rotation for enterprise-grade security.

1. Session API Fundamentals

Unlike simple key/value storage, the XEMS session layer manages opaque tokens and their entire lifecycle, including automatic encryption and resolution.

const runner = xems.forApp(app);
const token = await runner.createSession(
    "auth-pending",
    { email: "user@example.com", mfa_verified: false },
    { ttl: "15m" }
);

const session = await runner.resolveSession(token, {
    sandbox: "auth-pending",
    rotate: true,       // Generate a new token atomically
    gracePeriod: 2000,  // 2s overlap for concurrent requests
});

2. Implementing MFA Workflow

A secure multi-factor authentication flow involves migrating data between sandboxes as verification steps are completed.

router.post("/mfa/verify", async (req, res) => {
    const runner = xems.forApp(req.app);
    const tempSession = await runner.from("otp-pending").get(req.body.tempToken);

    if (isOtpValid(req.body.code)) {
        // High-level API handles cookie injection and final session linking
        await res.xLink({ userId: tempSession.userId, role: "admin" });
        
        // Cleanup the temporary sandbox
        await runner.from("otp-pending").del(req.body.tempToken);
    }
});

3. Security Best Practices