Merge remote-tracking branch 'refs/remotes/origin/v3' into v3

docs/malta.config.json

@@ -48,7 +48,7 @@
 			"pages": [
 				["Discord", "https://discord.com/invite/PwrK3kpVR3"],
 				["GitHub", "https://github.com/lucia-auth/lucia"],
-				["Twitter", "https://twitter.com/lucia-auth"]
+				["Twitter", "https://twitter.com/lucia_auth"]
 			]
 		}
 	]

docs/pages/basics/configuration.md

@@ -19,7 +19,7 @@ interface Options {
 
 ## `sessionExpiresIn`
 
-Configures how long a session is valid max for inactive users. Sessions expiration are automatically extended for active users. Also see [`TimeSpan`](/reference/main/TimeSpan).
+Configures how long a session stays valid for inactive users. Session expirations are automatically extended for active users. Also see [`TimeSpan`](/reference/main/TimeSpan).
 
 ```ts
 import { Lucia, TimeSpan } from "lucia";

docs/pages/basics/sessions.md

@@ -4,7 +4,7 @@ title: "Sessions"
 
 # Sessions
 
-Sessions allow Lucia to keep track of requests made by authenticated users. The id can be stored in a cookie or used as a traditional token manually added to each request. They should be created and stored on registration and login, validated on every request, and deleted on sign out.
+Sessions allow Lucia to keep track of requests made by authenticated users. The ID can be stored in a cookie or used as a traditional token manually added to each request. They should be created and stored on registration and login, validated on every request, and deleted on sign out.
 
 ```ts
 interface Session extends SessionAttributes {
@@ -17,9 +17,9 @@ interface Session extends SessionAttributes {
 
 ## Session lifetime
 
-Sessions do not have an absolute expiration. The expiration gets extended whenever they're used. This ensures that active users are signed in, while inactive users are signed out.
+Sessions do not have an absolute expiration. The expiration gets extended whenever they're used. This ensures that active users remain signed in, while inactive users are signed out.
 
-More specifically, if the session expiration is set to 30 days (default), Lucia will extend the expiration by another 30 days when there's less than 15 days (half of the expiration) until expiration. You can configure the expiration with the `sessionExpiresIn` configuration.
+More specifically, if the session expiration is set to 30 days (default), Lucia will extend the expiration by another 30 days when there are less than 15 days (half of the expiration) until expiration. You can configure the expiration with the `sessionExpiresIn` configuration.
 
 ```ts
 import { Lucia, TimeSpan } from "lucia";
@@ -45,7 +45,7 @@ declare module "lucia" {
 }
 ```
 
-You can then include them into the session object with the `getSessionAttributes()` configuration.
+You can then include them in the session object with the `getSessionAttributes()` configuration.
 
 ```ts
 const lucia = new Lucia(adapter, {
@@ -62,7 +62,7 @@ session.ipCountry;
 
 We do not automatically expose all database columns as
 
-1. Each project has their code styling rules
+1. Each project has its own code styling rules
 2. You generally don't want to expose sensitive data (even worse if you send the entire session object to the client)
 
 ## Create sessions
@@ -116,7 +116,7 @@ const sessionId = lucia.readSessionCookie("auth_session=abc");
 const sessionId = lucia.readBearerToken("Bearer abc");
 ```
 
-See the [Validate session cookies](/guides/validate-session-cookies) and [Validate bearer tokens](/guides/validate-bearer-tokens) guide for a full example for validating session cookies.
+See the [Validate session cookies](/guides/validate-session-cookies) and [Validate bearer tokens](/guides/validate-bearer-tokens) guide for a full example of validating session cookies.
 
 ## Session cookies
 

docs/pages/basics/users.md

@@ -51,7 +51,7 @@ interface DatabaseUserAttributes {
 }
 ```
 
-You can then include them into the user object with the `getUserAttributes()` configuration.
+You can then include them in the user object with the `getUserAttributes()` configuration.
 
 ```ts
 const lucia = new Lucia(adapter, {
@@ -70,5 +70,5 @@ if (user) {
 
 We do not automatically expose all database columns as
 
-1. Each project has their code styling rules
+1. Each project has its own code styling rules
 2. You generally don't want to expose sensitive data such as hashed passwords (even worse if you send the entire user object to the client)

docs/pages/getting-started/astro.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
 
 ```ts
 // src/auth.ts
@@ -38,7 +38,7 @@ declare module "lucia" {
 }
 ```
 
-## Setup middleware
+## Set up middleware
 
 We recommend setting up a middleware to validate requests. The validated user will be available as `local.user`. You can just copy-paste the code into `src/middleware.ts`.
 

docs/pages/getting-started/express.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
 
 ```ts
 import { Lucia } from "lucia";

docs/pages/getting-started/index.md

@@ -24,7 +24,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
 
 ```ts
 import { Lucia } from "lucia";

docs/pages/getting-started/nextjs-app.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
 
 ```ts
 // src/auth.ts

docs/pages/getting-started/nextjs-pages.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
 
 ```ts
 // src/auth.ts
@@ -53,7 +53,7 @@ globalThis.crypto = webcrypto as Crypto;
 node --experimental-web-crypto index.js
 ```
 
-## Setup middleware
+## Set up middleware
 
 If you're planning to use cookies, you must implement CSRF protection.
 

docs/pages/getting-started/nuxt.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure you configure the `sessionCookie` option and register your `Lucia` instance type.
 
 - Configure the `sessionCookie` option
 - Register your `Lucia` instance type
@@ -57,7 +57,7 @@ globalThis.crypto = webcrypto as Crypto;
 node --experimental-web-crypto index.js
 ```
 
-## Setup middleware
+## Set up middleware
 
 We recommend setting up a middleware to validate requests. The validated user will be available as `event.context.user`. You can just copy-paste the code into `server/middleware/auth.ts`.
 

docs/pages/getting-started/solidstart.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
 
 ```ts
 // src/lib/auth.ts
@@ -38,7 +38,7 @@ declare module "lucia" {
 }
 ```
 
-## Setup middleware
+## Set up middleware
 
 We recommend setting up a middleware to validate requests. The validated user will be available as `context.user`. You can just copy-paste the code into `src/middleware.ts`.
 

docs/pages/getting-started/sveltekit.md

@@ -14,7 +14,7 @@ npm install lucia@beta oslo
 
 ## Initialize Lucia
 
-Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to setup your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
+Import `Lucia` and initialize it with your adapter. Refer to the [Database](/database) page to learn how to set up your database and initialize the adapter. Make sure to configure the `sessionCookie` option and register your `Lucia` instance type
 
 ```ts
 // src/lib/server/auth.ts

docs/pages/guides/email-and-password/basics.md

@@ -4,7 +4,7 @@ title: "Password basics"
 
 # Password basics
 
-This page covers how to implement a password-based auth with Lucia. If you're looking for a step-by-step, framework specific tutorial, you may want to check out the [Username and password](/tutorials/username-and-password) tutorial. Keep in mind that email based auth requires more than just passwords!
+This page covers how to implement a password-based auth with Lucia. If you're looking for a step-by-step, framework-specific tutorial, you may want to check out the [Username and password](/tutorials/username-and-password) tutorial. Keep in mind that email-based auth requires more than just passwords!
 
 ## Update database
 
@@ -15,7 +15,7 @@ Add a unique `email` and `hashed_password` column to the user table.
 | `email`           | `string` | unique     |
 | `hashed_password` | `string` |            |
 
-Declare the type with `DatabaseUserAttributes` and add the attributes the user object using the `getUserAttributes()` configuration.
+Declare the type with `DatabaseUserAttributes` and add the attributes to the user object using the `getUserAttributes()` configuration.
 
 ```ts
 // auth.ts

docs/pages/guides/email-and-password/index.md

@@ -4,7 +4,7 @@ title: "Email and password"
 
 # Email and password
 
-Email based auth requires a lot of components so be prepared to do some work! For a step-by-step, framework specific tutorial to learn the basics of password based auth and Lucia, see the [Username and password](/tutorials/username-and-password) tutorial.
+Email-based auth requires a lot of components so be prepared to do some work! For a step-by-step, framework-specific tutorial to learn the basics of password-based auth and Lucia, see the [Username and password](/tutorials/username-and-password) tutorial.
 
 - [Password basics](/guides/email-and-password/basics)
 - Email verification

docs/pages/guides/oauth/basics.md

@@ -4,7 +4,7 @@ title: "OAuth basics"
 
 # OAuth basics
 
-For a step-by-step, framework specific tutorial, see the [GitHub OAuth](/tutorials) tutorial.
+For a step-by-step, framework-specific tutorial, see the [GitHub OAuth](/tutorials) tutorial.
 
 We recommend using [Arctic](https://github.com/pilcrowonpaper/arctic) for implementing OAuth 2.0. It is a lightweight library that provides APIs for creating authorization URLs, validating callbacks, and refreshing access tokens. This is the easiest way to implement OAuth with Lucia and it supports most major providers. This page will use GitHub, and while most providers have similar APIs, there might be some minor differences between them.
 
@@ -23,7 +23,7 @@ Add a `username` and a unique `github_id` column to the user table.
 | `username`  | `string` |            |
 | `github_id` | `number` | unique     |
 
-Declare the type with `DatabaseUserAttributes` and add the attributes the user object using the `getUserAttributes()` configuration.
+Declare the type with `DatabaseUserAttributes` and add the attributes to the user object using the `getUserAttributes()` configuration.
 
 ```ts
 // auth.ts
@@ -81,7 +81,7 @@ app.get("/login/github", async (): Promise<Response> => {
 		status: 302,
 		headers: {
 			Location: url.toString(),
-			"Set-Cookie": serializeCookie("oauth_state", state, {
+			"Set-Cookie": serializeCookie("github_oauth_state", state, {
 				httpOnly: true,
 				secure: env === "PRODUCTION", // set `Secure` flag in HTTPS
 				maxAge: 60 * 10, // 10 minutes
@@ -100,7 +100,7 @@ You can now create a sign in button with just an anchor tag.
 
 ## Validate callback
 
-In the callback route, first get the state from the cookie and the search params and compare them. Validate the authorization code in the search params with `validateAuthorizationCode()`. This will throw a [`OAuth2RequestError`](https://oslo.js.org/reference/oauth2/OAuth2RequestError) if the code or credentials are invalid. After validating the code, get the user's profile using the access token. Check if the user is already registered with the GitHub ID and create a new user if not. Finally, create a new session and set the session cookie.
+In the callback route, first get the state from the cookie and the search params and compare them. Validate the authorization code in the search params with `validateAuthorizationCode()`. This will throw an [`OAuth2RequestError`](https://oslo.js.org/reference/oauth2/OAuth2RequestError) if the code or credentials are invalid. After validating the code, get the user's profile using the access token. Check if the user is already registered with the GitHub ID, and create a new user if they aren't. Finally, create a new session and set the session cookie.
 
 ```ts
 import { github, lucia } from "./auth.js";
@@ -110,7 +110,7 @@ import { parseCookies } from "oslo/cookie";
 
 app.get("/login/github/callback", async (request: Request): Promise<Response> => {
 	const cookies = parseCookies(request.headers.get("Cookie") ?? "");
-	const stateCookie = cookies.get("oauth_state") ?? null;
+	const stateCookie = cookies.get("github_oauth_state") ?? null;
 
 	const url = new URL(request.url);
 	const state = url.searchParams.get("state");

docs/pages/guides/oauth/index.md

@@ -6,7 +6,7 @@ title: "OAuth"
 
 OAuth, or social sign in, is the easiest way to implement authentication as you won't have to worry about email verification, passwords, and two-factor authorization.
 
-For a step-by-step, framework specific tutorial, see the [GitHub OAuth](/tutorials/github-oauth) tutorial.
+For a step-by-step, framework-specific tutorial, see the [GitHub OAuth](/tutorials/github-oauth) tutorial.
 
 - [OAuth basics](/guides/oauth/basics)
 - [Multiple OAuth providers](/guides/oauth/multiple-providers)

docs/pages/guides/oauth/multiple-providers.md

@@ -30,7 +30,7 @@ We can then remove the `github_id` column etc from the user table.
 
 ## Validating callback
 
-Instead of the user table, we can now use the OAuth account table to check if a user is already registered. If not, in an transaction, create the user and OAuth account.
+Instead of the user table, we can now use the OAuth account table to check if a user is already registered. If not, in a transaction, create the user and OAuth account.
 
 ```ts
 const tokens = await githubAuth.validateAuthorizationCode(code);

docs/pages/guides/oauth/pkce.md

@@ -21,7 +21,7 @@ app.get("/login/twitter", async (): Promise<Response> => {
 	const headers = new Headers();
 	headers.append(
 		"Set-Cookie",
-		serializeCookie("state", state, {
+		serializeCookie("twitter_oauth_state", state, {
 			httpOnly: true,
 			secure: env === "PRODUCTION", // set `Secure` flag in HTTPS
 			maxAge: 60 * 10, // 10 minutes
@@ -52,7 +52,7 @@ import { parseCookies } from "oslo/cookie";
 
 app.get("/login/twitter/callback", async (request: Request): Promise<Response> => {
 	const cookies = parseCookies(request.headers.get("Cookie") ?? "");
-	const stateCookie = cookies.get("oauth_state") ?? null;
+	const stateCookie = cookies.get("twitter_oauth_state") ?? null;
 	const codeVerifier = cookies.get("code_verifier") ?? null;
 
 	const url = new URL(request.url);

docs/pages/guides/troubleshooting.md

@@ -8,7 +8,7 @@ Here are some common issues and how to resolve them. Feel free to ask for help i
 
 ## `User` and `Session` are typed as `any`
 
-Make sure you've registered your types. Check the `typeof lucia` is indeed an instance of `Lucia` (not a function that returns `Lucia`) and that there are no TS errors (including `@ts-ignore`) when declaring `Lucia`. `Register` must be an `interface`, not `type`.
+Make sure you've registered your types. Check that the `typeof lucia` is indeed an instance of `Lucia` (not a function that returns `Lucia`) and that there are no TS errors (including `@ts-ignore`) when declaring `Lucia`. `Register` must be an `interface`, not a `type`.
 
 ```ts
 import { Lucia } from "lucia";
@@ -26,7 +26,7 @@ declare module "lucia" {
 
 ## Session cookies are not set in `localhost`
 
-By default, session cookies have a `Secure` flag, which require HTTPS. You can disable it for development with the `sessionCookie.attributes.secure` configuration.
+By default, session cookies have a `Secure` flag, which requires HTTPS. You can disable it for development with the `sessionCookie.attributes.secure` configuration.
 
 ```ts
 import { Lucia } from "lucia";

docs/pages/guides/validate-session-cookies/astro.md

@@ -4,7 +4,7 @@ title: "Validate session cookies in Astro"
 
 # Validate session cookies in Astro
 
-**CSRF protection must be implemented when using cookies and forms** This can be easily done by comparing the `Origin` and `Host` header.
+**CSRF protection must be implemented when using cookies and forms.** This can be easily done by comparing the `Origin` and `Host` header.
 
 We recommend creating a middleware to validate requests and store the current user inside `locals`. You can get the cookie name with `Lucia.sessionCookieName` and validate the session cookie with `Lucia.validateSession()`. Make sure to delete the session cookie if it's invalid and create a new session cookie when the expiration gets extended, which is indicated by `Session.fresh`.
 

docs/pages/guides/validate-session-cookies/express.md

@@ -4,7 +4,7 @@ title: "Validate session cookies in Express"
 
 # Validate session cookies in Express
 
-**CSRF protection must be implemented when using cookies and forms** This can be easily done by comparing the `Origin` and `Host` header.
+**CSRF protection must be implemented when using cookies and forms.** This can be easily done by comparing the `Origin` and `Host` header.
 
 We recommend creating 2 middleware for CSRF protection and validating requests. You can get the cookie with `Lucia.readSessionCookie()` and validate the session cookie with `Lucia.validateSession()`. Make sure to delete the session cookie if it's invalid and create a new session cookie when the expiration gets extended, which is indicated by `Session.fresh`.