Most web applications still approach session security as a simple checklist: enforce strong passwords, add rate limiting, maybe enable 2FA. But in practice, many real-world attacks occur after a user has already authenticated, when the session itself appears legitimate.
Because of this, security is gradually shifting away from one-time authentication checks toward continuous session evaluation. Instead of trusting a session indefinitely after login, systems need to keep assessing whether the behavior behind that session still looks normal.
This is the idea behind onuion.
Onuion is a lightweight, self-hostable component designed to sit alongside your authentication flow and continuously evaluate session risk in real time. It analyzes behavioral signals and assigns a risk score to active sessions, helping detect suspicious activity even when credentials were valid.
Rather than relying only on static rules or external security platforms, onuion allows you to bring behavioral risk analysis directly into your own infrastructure.
Design principles:
<ul>
<li>hybrid approach: rule-based logic + lightweight ML detection</li>
<li>extremely small model (~2k parameters) for minimal resource usage</li>
<li>sub-millisecond inference target to avoid slowing down authentication</li>
<li>simple integration with admin panels, API gateways, or internal services</li>
</ul>
If you operate your own infrastructure and want stronger protection against account takeover without heavy security stacks, this approach might be worth exploring.
Repo: <a href="https://github.com/onuion/onuion" target="_blank" rel="noopener nofollow">https://github.com/onuion/onuion</a>

A safe space for developers interested in open source projects, articles, tips and useful coding tools.

OpenSouls

Onuion is a lightweight, self-hostable session security component that continuously evaluates session risk in real time rather than relying solely on one-time authentication checks. It analyzes behavioral signals and assigns risk scores to active sessions using a hybrid approach combining rule-based logic with a minimal ML model (~2k parameters) targeting sub-millisecond inference. Designed for self-hosted infrastructure, it integrates with admin panels, API gateways, or internal services to detect account takeover attempts without requiring heavy external security stacks.

Secure your web app from real-time session attacks