# session-sync-auth-site

> Run `node ./node_modules/session-sync-auth-site/src/createDBTables.js [mysql_connection_string] [user_table_name] [session_table_name]`

Latest version **4.0.11** (published 2026-01-08) · MIT license · 0 weekly downloads

## Install

```sh
npm install session-sync-auth-site
pnpm add session-sync-auth-site
yarn add session-sync-auth-site
bun add session-sync-auth-site
```

## Health

**Score 45/100 (D)** — status: stable.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

## Facts

| | |
|---|---|
| Version | 4.0.11 |
| Published | 2026-01-08 |
| First published | 2022-01-12 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=20 |
| Dependencies | 3 |
| Unpacked size | 44.5 KB |
| Known vulnerabilities | 0 (+3 in 1 direct dependencies) |
| Install scripts | no |
| Author | Andy Hubert |
| Maintainers | andyhubert |

## Links

- npm: https://www.npmjs.com/package/session-sync-auth-site
- Repository: https://github.com/educational-resources-and-services/session-sync-auth-site
- Homepage: https://github.com/educational-resources-and-services/session-sync-auth-site#readme
- Issues: https://github.com/educational-resources-and-services/session-sync-auth-site/issues
- npm.io page: https://npm.io/package/session-sync-auth-site

## Dependencies (3)

- [mysql2](https://npm.io/package/mysql2.md) ^3.16.0
- [jsonwebtoken](https://npm.io/package/jsonwebtoken.md) ^8.5.1
- [connection-string](https://npm.io/package/connection-string.md) ^4.3.2

## Recent versions

- 4.0.11 (latest) — 2026-01-08
- 4.0.10 — 2026-01-05
- 4.0.9 — 2026-01-02
- 4.0.8 — 2026-01-02
- 4.0.7 — 2026-01-02
- 4.0.6 — 2026-01-02
- 4.0.5 — 2026-01-01
- 4.0.4 — 2026-01-01
- 4.0.3 — 2026-01-01
- 4.0.2 — 2026-01-01
- 4.0.1 — 2026-01-01
- 4.0.0 — 2025-12-30
- 3.0.5 — 2025-12-23
- 3.0.4 — 2025-12-22
- 3.0.3 — 2025-12-22
- … 21 more at https://npm.io/package/session-sync-auth-site/versions

## README

# Setup

Run `node ./node_modules/session-sync-auth-site/src/createDBTables.js [mysql_connection_string] [user_table_name] [session_table_name]`

Example: `node ./node_modules/session-sync-auth-site/src/createDBTables.js mysql://root@localhost/SessionSyncAuthSite users sessions`

You may add on more fields to the user and session tables, if you like.

# Simple backend usage

```js
const express = require('express')
const app = express()
const cors = require('cors')
const bodyParser = require('body-parser')

const { authenticate, setUpSessionSyncAuthRoutes } = require('session-sync-auth-site')

app.use(cors())
app.use(bodyParser.json())

app.use(authenticate({
  // either `connectionObj` or `connectionStr` is required
  connectionObj: {
    host,
    user,
    password,
    database,
    port,
  },
}))

setUpSessionSyncAuthRoutes({
  app,
  siteId,
  authFrontendBaseUrl,
  authBackendBaseUrl,
  jwtSecret,
})
```

## Exhaustive options for authenticate with default values

```js
app.use(authenticate({
  // either `connectionObj` or `connectionStr` required
  connectionObj: {
    host,
    user,
    password,
    database,
    port,
  },
  userTableName: 'users',
  sessionTableName: 'sessions',
  userTableColNameMap: {
    // Example:
    // updated_at: 'updatedAt',
  },
  extraUserTableSelectValues: {
    // Use this when the user table id column is not unique.
    // (Often the case with a multi-tenacy setup.)
    // In such a case, add other WHERE parameters here to combine with
    // the id column such that combination is unique.
    // Note: These parameters will typically coincide with `extraUserTableValues` below.
    // Example:
    // tenantId: 34,
  },
  sessionTableColNameMap: {},
}))
```

## Exhaustive options for setUpSessionSyncAuthRoutes with default values

```js
setUpSessionSyncAuthRoutes({
  app,  // required
  siteId,  // required (unless getSetupInfo provided)
  authFrontendBaseUrl,  // required (unless getSetupInfo provided)
  authBackendBaseUrl,  // required (unless getSetupInfo provided)
  jwtSecret,  // required (unless getSetupInfo provided)
  getSetupInfo: req => {  // useful for multi-tenancy setups
    // fetch the needed values based upon req
    return {
      siteId,
      authFrontendBaseUrl,
      authBackendBaseUrl,
      jwtSecret,
      extraUserTableValues,  // optional
      // Note: In a multi-tenancy setup, `extraUserTableValues` should
      // typically coincide with `extraUserTableSelectValues` above.
    }
  },
  mergeUser: async ({ id, mergeToUserId, req }) => {  // optional (when absent, merge requests will succeed even though no data is merged for this site)
    // move all of user's data to mergeToUserId
  },
  deleteUser: async ({ id, req }) => {  // optional (when absent, the appropriate rows from users and sessions are deleted)
    // delete all of user's data, including appropriate rows from users and sessions tables
  },
  paths: {
    getUser: '/get-user',
    logIn: '/log-in',
    logOut: '/log-out',
    authSync: '/auth-sync',
  },
  languageColType: '639-3',  // OPTIONS: '639-1', '639-3', 'IETF'
})
```

## Admin backend functions

```js
const { createUser, getLoginLink, updateUserAccount, deleteUser } = require('session-sync-auth-site')

app.post(`create-user`, (req, res, next) => {
  // first check that user is admin with permission to do this
  const userId = await createUser({
    email: req.body.email,
    req,
  })
  res.send({ userId })
})

app.post(`get-login-link`, (req, res, next) => {
  // first check that user is admin with permission to do this
  const loginLink = await getLoginLink({
    email: req.body.email,
    redirectUrl: req.body.redirectUrl,  // must begin with the frontend domain (default: req.headers.origin)
    origin: `https://my-backend-domain.com`,  // default: `${req.protocol}://${req.headers.host}`
    req,
  })
  res.send({ loginLink })
})

app.post(`update-user-account`, (req, res, next) => {
  // first check that user is admin with permission to do this
  await updateUserAccount({
    userId: req.body.userId,
    data: {  // only include details being updated
      name: req.body.name,
      email: req.body.email,
      image: req.body.image,
      language: req.body.language,
      terms: req.body.terms,
      image: req.body.image,
      gender: req.body.gender,
    },
    req,
  })
  res.send({ success: true })
})

app.post(`delete-user`, (req, res, next) => {
  // first check that user is admin with permission to do this
  await deleteUser({
    id: req.body.id,
    mergeToUserId: req.body.mergeToUserId,  // optional
    req,
  })
  res.send({ success: true })
})
```

# Frontend usage

```html
<html>
  <head>
    <script src="[private_url]/sessionSyncAuthFrontend.js"></script>

    <script>

      window.sessionSyncAuth.init({
        defaultOrigin: 'https://my-backend-domain.com',
        callbacks: {
          canceledLogin: ({ origin }) => {},
          successfulLogin: ({ origin, accessToken }) => {},
          canceledAccountUpdate: ({ origin }) => {},
          successfulAccountUpdate: ({ origin }) => {},
          successfulLogout: ({ origin }) => {},
          unnecessaryLogout: ({ origin }) => {},
          error: ({ errorMessage }) => {},
        },
        // enabledSSR: true,  // Include this if you use server-side-rendering
      })

      // To change the default origin...
      // window.sessionSyncAuth.setDefaultOrigin('https://my-backend-domain.com')

      // When getting data from your backend via AJAX, add in a x-access-token header...
      // const response = await fetch(url, {
      //   headers: {
      //     'x-access-token': window.sessionSyncAuth.getAccessToken(),
      //   },
      // })

    </script>
  <head>

  <body>

    <!-- All functions below can also take a single options parameter with an `origin` key. -->

    <button onclick="javascript:window.sessionSyncAuth.getAccessToken()">Get Access Token</button>

    <button onclick="javascript:window.sessionSyncAuth.logIn()">Sign in</button>

    <button onclick="javascript:window.sessionSyncAuth.updateAccount()">Update my account</button>

    <button onclick="javascript:window.sessionSyncAuth.getUser()">Get user</button>

    <button onclick="javascript:window.sessionSyncAuth.logOut()">Log out</button>

  </body>

</html>
```

---
_Source: https://npm.io/package/session-sync-auth-site · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._