wasp-auth

User authentication in Wasp applications is configured by defining a User model and enabling auth methods—username/password, email, or OAuth providers like Google and GitHub. Wasp manages auth tables, password hashing, and session handling automatically, so you define your schema and routes without writing security boilerplate.

Yes, Wasp supports multiple authentication methods simultaneously. You can combine email/password authentication with OAuth providers like Google and GitHub in a single application, letting users choose their preferred login method while maintaining unified user management.

Wasp provides helper accessors like getEmail() and getUsername() to safely retrieve authenticated user fields on both client and server. Protected routes automatically enforce authentication, and Wasp's built-in patterns prevent unauthorized access without manual permission logic.

Wasp authentication requires only a User model with an id field. Wasp automatically creates and manages auth-related tables for passwords, sessions, and OAuth tokens, so you avoid defining authentication infrastructure manually.

Wasp includes prebuilt authentication pages for login and signup flows. These pages handle form validation, password security, and OAuth integration, so you can enable user registration and login without designing UI or writing authentication handlers from scratch.

Wasp enforces secure password handling with hashing, session management, and a minimal User model design that reduces attack surface. These patterns prevent common vulnerabilities like plaintext password storage and unauthorized data exposure across client and server code.