Nuxt Bearer Auth
Technical Deep Dive

Architecture & Security Model

Explore the multi-tier authentication architecture that separates browser sessions from external API bearer tokens.

System Boundaries Overview

Security Boundary Architecture

How Nuxt Bearer Auth Isolates Tokens

Client

Browser

Vue / Nuxt SPA

HTTP-Only Cookie
nuxt_bearer_auth_session=UUID
No Plaintext Tokens
Gateway

Nuxt Server

Nitro Auth Gateway

Session Hydrator
/api/auth/* endpoints
SSR Auth Ready
Storage

Redis Cache

Session Store (TTL)

Stores Bearer Token
session:UUID (TTL 7d)
Fast Key Lookup
Backend

External API

Laravel / REST API

Issues Bearer Token
Authorization: Bearer ...
Agnostic Protocol
1. User Submits CredentialsBrowser ➔ Nuxt Server

Browser sends login request to local Nuxt endpoint (/api/auth/login).

Interactive Sequence Flows

Login & Session Creation

User enters credentials. Nuxt authenticates with your backend API, receives the bearer token, stores it securely in Redis, and issues an HTTP-only cookie.

1
BrowserNuxt Server
POST /api/auth/login { email/username, password }
Local Nuxt API route
2
Nuxt ServerBackend API
POST https://api.example.com/auth/login
Direct server-to-server call
3
Backend APINuxt Server
200 OK { token: "secret_bearer_token", user: {...} }
Bearer token received on server
4
Nuxt ServerRedis
SETEX session:<uuid> 604800 { token, profile, ... }
Stored in server memory with TTL
5
Nuxt ServerBrowser
Set-Cookie: nuxt_bearer_auth_session=<uuid>; HttpOnly; Secure
Browser receives session UUID only

The 5 Architectural Layers

How responsibilities are partitioned across the stack.

1Vue 3 Composition API / useState()

Client / Nuxt Composable Layer

Provides reactive state (user, isAuthenticated, status, loading) and action composables (login, logout, refresh, verifyOtp) via useBearerAuth(). Holds only session state, zero raw bearer tokens.

2H3 Event Handlers / Nitro Server Engine

Nitro Server Auth Routes Layer

Local endpoints mounted under /api/auth/* (/login, /logout, /me, /refresh, /sessions) that handle CSRF verification, input normalization, and request proxying.

3Node Crypto / H3 Cookie Utilities

Session Manager Layer

Generates cryptographically random UUID session IDs, issues secure HTTP-only cookies, updates last-activity timestamps, manages sliding session TTLs, and indexes multi-device logins under user_sessions:userId sets.

4Redis 6/7 Protocol / node-redis Client

Redis Storage Layer

High-speed in-memory database storing JSON serialized session payloads (session:<uuid>) and active device session sets with automated expiration.

5ofetch / Response Normalizer

External API Adapter Layer

Universal HTTP caller (callAuthApi) that resolves server-held bearer tokens and proxies requests to external backends with dynamic response path mapping.