securing-authentication

Name: securing-authentication
Author: ancoleman

74installs59forks

How to install securing-authentication?

ancoleman/ai-design-components/securing-authentication

$npx -y skills add ancoleman/ai-design-components --skill securing-authentication

Installs into the current project.

Summary

Authentication, authorization, and API security implementation. Use when building user systems, protecting APIs, or implementing access control. Covers OAuth 2.1/OIDC, JWT patterns, sessions, Passkeys/WebAuthn, RBAC/ABAC/ReBAC, policy engines (OPA, Casbin, SpiceDB), managed auth

Files · 1

View on GitHub

SKILL.md

1	# Authentication & Security
2
3	Implement modern authentication, authorization, and API security across Python, Rust, Go, and TypeScript.
4
5	## When to Use This Skill
6
7	Use this skill when:
8	- Building user authentication systems (login, signup, SSO)
9	- Implementing authorization (roles, permissions, access control)
10	- Securing APIs (JWT validation, rate limiting)
11	- Adding passwordless auth (Passkeys/WebAuthn)
12	- Migrating from password-based to modern auth
13	- Integrating enterprise SSO (SAML, OIDC)
14	- Implementing fine-grained permissions (RBAC, ABAC, ReBAC)
15
16	## OAuth 2.1 Mandatory Requirements (2025 Standard)
17
18	```
19	┌─────────────────────────────────────────────────────────────┐
20	│ OAuth 2.1 MANDATORY REQUIREMENTS │
21	│ (RFC 9798 - 2025) │
22	├─────────────────────────────────────────────────────────────┤
23	│ │
24	│ ✅ REQUIRED (Breaking Changes from OAuth 2.0) │
25	│ ├─ PKCE (Proof Key for Code Exchange) MANDATORY │
26	│ │ └─ S256 method (SHA-256), minimum entropy 43 chars │
27	│ ├─ Exact redirect URI matching │
28	│ │ └─ No wildcard matching, no substring matching │
29	│ ├─ Authorization code flow ONLY for public clients │
30	│ │ └─ All other flows require confidential client │
31	│ └─ TLS 1.2+ required for all endpoints │
32	│ │
33	│ ❌ REMOVED (No Longer Supported) │
34	│ ├─ Implicit grant (security vulnerabilities) │
35	│ ├─ Resource Owner Password Credentials grant │
36	│ │ └─ Use OAuth 2.0 Device Flow (RFC 8628) instead │
37	│ └─ Bearer token in query parameters │
38	│ └─ Must use Authorization header or POST body │
39	│ │
40	└─────────────────────────────────────────────────────────────┘
41	```
42
43	Critical: PKCE is now mandatory for ALL OAuth flows, not just public clients.
44
45	## JWT Best Practices
46
47	### Signing Algorithms (Priority Order)
48
49	1. EdDSA with Ed25519 (Recommended)
50	- Fastest performance
51	- Smallest signature size
52	- Modern cryptography
53
54	2. ES256 (ECDSA with P-256)
55	- Good performance
56	- Industry standard
57	- Wide compatibility
58
59	3. RS256 (RSA)
60	- Legacy compatibility
61	- Larger signatures
62	- Slower performance
63
64	NEVER allow `alg: none` or algorithm switching attacks.
65
66	### Token Lifetimes (Concrete Values)
67
68	- Access token: 5-15 minutes
69	- Refresh token: 1-7 days with rotation
70	- ID token: Same as access token (5-15 minutes)
71
72	Refresh token rotation: Each refresh generates new access AND refresh tokens, invalidating the old refresh token.
73
74	### Token Storage
75
76	- Access token: Memory only (never localStorage)
77	- Refresh token: HTTP-only cookie + SameSite=Strict
78	- CSRF token: Separate non-HTTP-only cookie
79	- Never log tokens: Redact in application logs
80
81	### JWT Claims (Required)
82
83	```json
84	{
85	"iss": "https://auth.example.com",
86	"sub": "user-id-123",
87	"aud": "api.example.com",
88	"exp": 1234567890,
89	"iat": 1234567890,
90	"jti": "unique-token-id",
91	"scope": "read:profile write:data"
92	}
93	```
94
95	## Password Hashing with Argon2id
96
97	### OWASP 2025 Parameters
98
99	```
100	Algorithm: Argon2id
101	Memory cost (m): 64 MB (65536 KiB)
102	Time cost (t): 3 iterations
103	Parallelism (p): 4 threads
104	Salt length: 16 bytes (128 bits)
105	Target hash time: 150-250ms
106	```
107
108	### Implementation
109
110	For concrete implementations, see `references/password-hashing.md`.
111
112	Key Points:
113	- Argon2id is hybrid: data-independent timing + memory-hard
114	- Tune memory cost to achieve 150-250ms on YOUR hardware
115	- Use timing-safe comparison for verification
116	- Migrate from bcrypt gradually (verify with old, rehash with new)
117
118	## Passkeys / WebAuthn
119
120	Passkeys provide phishing-resistant, passwordless authentication using FIDO2/WebAuthn.
121
122	### When to Use Passkeys
123
124	- User-facing applications prioritizing security
125	- Reducing password-related support burden
126	- Mobile-first applications (biometric auth)
127	- Applications requiring MFA without SMS
128
129	### Cross-Device Passkey Sync
130
131	- iCloud Keychain: Apple ecosystem (iOS 16+, macOS 13+)
132	- Google Password Manager: Android, Chrome
133	- 1Password, Bitwarden: Third-party password managers
134
135	For implementation guide, see `references/passkeys-webauthn.md`.
136
137	## Authorization Models
138
139	```
140	┌─────────────────────────────────────────────────────────────┐
141	│ Authorization Model Selection

People who liked this also viewed

6 picks

Type

securing-authentication

74installs59forks

View on GitHub

How to install securing-authentication?

ancoleman/ai-design-components/securing-authentication

$npx -y skills add ancoleman/ai-design-components --skill securing-authentication

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Authentication & Security
2
3	Implement modern authentication, authorization, and API security across Python, Rust, Go, and TypeScript.
4
5	## When to Use This Skill
6
7	Use this skill when:
8	- Building user authentication systems (login, signup, SSO)
9	- Implementing authorization (roles, permissions, access control)
10	- Securing APIs (JWT validation, rate limiting)
11	- Adding passwordless auth (Passkeys/WebAuthn)
12	- Migrating from password-based to modern auth
13	- Integrating enterprise SSO (SAML, OIDC)
14	- Implementing fine-grained permissions (RBAC, ABAC, ReBAC)
15
16	## OAuth 2.1 Mandatory Requirements (2025 Standard)
17
18	```
19	┌─────────────────────────────────────────────────────────────┐
20	│ OAuth 2.1 MANDATORY REQUIREMENTS │
21	│ (RFC 9798 - 2025) │
22	├─────────────────────────────────────────────────────────────┤
23	│ │
24	│ ✅ REQUIRED (Breaking Changes from OAuth 2.0) │
25	│ ├─ PKCE (Proof Key for Code Exchange) MANDATORY │
26	│ │ └─ S256 method (SHA-256), minimum entropy 43 chars │
27	│ ├─ Exact redirect URI matching │
28	│ │ └─ No wildcard matching, no substring matching │
29	│ ├─ Authorization code flow ONLY for public clients │
30	│ │ └─ All other flows require confidential client │
31	│ └─ TLS 1.2+ required for all endpoints │
32	│ │
33	│ ❌ REMOVED (No Longer Supported) │
34	│ ├─ Implicit grant (security vulnerabilities) │
35	│ ├─ Resource Owner Password Credentials grant │
36	│ │ └─ Use OAuth 2.0 Device Flow (RFC 8628) instead │
37	│ └─ Bearer token in query parameters │
38	│ └─ Must use Authorization header or POST body │
39	│ │
40	└─────────────────────────────────────────────────────────────┘
41	```
42
43	Critical: PKCE is now mandatory for ALL OAuth flows, not just public clients.
44
45	## JWT Best Practices
46
47	### Signing Algorithms (Priority Order)
48
49	1. EdDSA with Ed25519 (Recommended)
50	- Fastest performance
51	- Smallest signature size
52	- Modern cryptography
53
54	2. ES256 (ECDSA with P-256)
55	- Good performance
56	- Industry standard
57	- Wide compatibility
58
59	3. RS256 (RSA)
60	- Legacy compatibility
61	- Larger signatures
62	- Slower performance
63
64	NEVER allow `alg: none` or algorithm switching attacks.
65
66	### Token Lifetimes (Concrete Values)
67
68	- Access token: 5-15 minutes
69	- Refresh token: 1-7 days with rotation
70	- ID token: Same as access token (5-15 minutes)
71
72	Refresh token rotation: Each refresh generates new access AND refresh tokens, invalidating the old refresh token.
73
74	### Token Storage
75
76	- Access token: Memory only (never localStorage)
77	- Refresh token: HTTP-only cookie + SameSite=Strict
78	- CSRF token: Separate non-HTTP-only cookie
79	- Never log tokens: Redact in application logs
80
81	### JWT Claims (Required)
82
83	```json
84	{
85	"iss": "https://auth.example.com",
86	"sub": "user-id-123",
87	"aud": "api.example.com",
88	"exp": 1234567890,
89	"iat": 1234567890,
90	"jti": "unique-token-id",
91	"scope": "read:profile write:data"
92	}
93	```
94
95	## Password Hashing with Argon2id
96
97	### OWASP 2025 Parameters
98
99	```
100	Algorithm: Argon2id
101	Memory cost (m): 64 MB (65536 KiB)
102	Time cost (t): 3 iterations
103	Parallelism (p): 4 threads
104	Salt length: 16 bytes (128 bits)
105	Target hash time: 150-250ms
106	```
107
108	### Implementation
109
110	For concrete implementations, see `references/password-hashing.md`.
111
112	Key Points:
113	- Argon2id is hybrid: data-independent timing + memory-hard
114	- Tune memory cost to achieve 150-250ms on YOUR hardware
115	- Use timing-safe comparison for verification
116	- Migrate from bcrypt gradually (verify with old, rehash with new)
117
118	## Passkeys / WebAuthn
119
120	Passkeys provide phishing-resistant, passwordless authentication using FIDO2/WebAuthn.
121
122	### When to Use Passkeys
123
124	- User-facing applications prioritizing security
125	- Reducing password-related support burden
126	- Mobile-first applications (biometric auth)
127	- Applications requiring MFA without SMS
128
129	### Cross-Device Passkey Sync
130
131	- iCloud Keychain: Apple ecosystem (iOS 16+, macOS 13+)
132	- Google Password Manager: Android, Chrome
133	- 1Password, Bitwarden: Third-party password managers
134
135	For implementation guide, see `references/passkeys-webauthn.md`.
136
137	## Authorization Models
138
139	```
140	┌─────────────────────────────────────────────────────────────┐
141	│ Authorization Model Selection

People who liked this also viewed

6 picks

Type