auth-implementation-patterns

Name: auth-implementation-patterns
Author: wshobson

11kinstalls4.1kforks

How to install auth-implementation-patterns?

wshobson/agents/auth-implementation-patterns

$npx -y skills add wshobson/agents --skill auth-implementation-patterns

Installs into the current project.

Summary

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Files · 1

View on GitHub

SKILL.md

1	# Authentication & Authorization Implementation Patterns
2
3	Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
4
5	## When to Use This Skill
6
7	- Implementing user authentication systems
8	- Securing REST or GraphQL APIs
9	- Adding OAuth2/social login
10	- Implementing role-based access control (RBAC)
11	- Designing session management
12	- Migrating authentication systems
13	- Debugging auth issues
14	- Implementing SSO or multi-tenancy
15
16	## Core Concepts
17
18	### 1. Authentication vs Authorization
19
20	Authentication (AuthN): Who are you?
21
22	- Verifying identity (username/password, OAuth, biometrics)
23	- Issuing credentials (sessions, tokens)
24	- Managing login/logout
25
26	Authorization (AuthZ): What can you do?
27
28	- Permission checking
29	- Role-based access control (RBAC)
30	- Resource ownership validation
31	- Policy enforcement
32
33	### 2. Authentication Strategies
34
35	Session-Based:
36
37	- Server stores session state
38	- Session ID in cookie
39	- Traditional, simple, stateful
40
41	Token-Based (JWT):
42
43	- Stateless, self-contained
44	- Scales horizontally
45	- Can store claims
46
47	OAuth2/OpenID Connect:
48
49	- Delegate authentication
50	- Social login (Google, GitHub)
51	- Enterprise SSO
52
53	## Detailed patterns and worked examples
54
55	Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
56
57	## Best Practices
58
59	1. Never Store Plain Passwords: Always hash with bcrypt/argon2
60	2. Use HTTPS: Encrypt data in transit
61	3. Short-Lived Access Tokens: 15-30 minutes max
62	4. Secure Cookies: httpOnly, secure, sameSite flags
63	5. Validate All Input: Email format, password strength
64	6. Rate Limit Auth Endpoints: Prevent brute force attacks
65	7. Implement CSRF Protection: For session-based auth
66	8. Rotate Secrets Regularly: JWT secrets, session secrets
67	9. Log Security Events: Login attempts, failed auth
68	10. Use MFA When Possible: Extra security layer
69
70	## Common Pitfalls
71
72	- Weak Passwords: Enforce strong password policies
73	- JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
74	- No Token Expiration: Tokens should expire
75	- Client-Side Auth Checks Only: Always validate server-side
76	- Insecure Password Reset: Use secure tokens with expiration
77	- No Rate Limiting: Vulnerable to brute force
78	- Trusting Client Data: Always validate on server

People who liked this also viewed

6 picks

Type

auth-implementation-patterns

11kinstalls4.1kforks

View on GitHub

How to install auth-implementation-patterns?

wshobson/agents/auth-implementation-patterns

$npx -y skills add wshobson/agents --skill auth-implementation-patterns

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Authentication & Authorization Implementation Patterns
2
3	Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
4
5	## When to Use This Skill
6
7	- Implementing user authentication systems
8	- Securing REST or GraphQL APIs
9	- Adding OAuth2/social login
10	- Implementing role-based access control (RBAC)
11	- Designing session management
12	- Migrating authentication systems
13	- Debugging auth issues
14	- Implementing SSO or multi-tenancy
15
16	## Core Concepts
17
18	### 1. Authentication vs Authorization
19
20	Authentication (AuthN): Who are you?
21
22	- Verifying identity (username/password, OAuth, biometrics)
23	- Issuing credentials (sessions, tokens)
24	- Managing login/logout
25
26	Authorization (AuthZ): What can you do?
27
28	- Permission checking
29	- Role-based access control (RBAC)
30	- Resource ownership validation
31	- Policy enforcement
32
33	### 2. Authentication Strategies
34
35	Session-Based:
36
37	- Server stores session state
38	- Session ID in cookie
39	- Traditional, simple, stateful
40
41	Token-Based (JWT):
42
43	- Stateless, self-contained
44	- Scales horizontally
45	- Can store claims
46
47	OAuth2/OpenID Connect:
48
49	- Delegate authentication
50	- Social login (Google, GitHub)
51	- Enterprise SSO
52
53	## Detailed patterns and worked examples
54
55	Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
56
57	## Best Practices
58
59	1. Never Store Plain Passwords: Always hash with bcrypt/argon2
60	2. Use HTTPS: Encrypt data in transit
61	3. Short-Lived Access Tokens: 15-30 minutes max
62	4. Secure Cookies: httpOnly, secure, sameSite flags
63	5. Validate All Input: Email format, password strength
64	6. Rate Limit Auth Endpoints: Prevent brute force attacks
65	7. Implement CSRF Protection: For session-based auth
66	8. Rotate Secrets Regularly: JWT secrets, session secrets
67	9. Log Security Events: Login attempts, failed auth
68	10. Use MFA When Possible: Extra security layer
69
70	## Common Pitfalls
71
72	- Weak Passwords: Enforce strong password policies
73	- JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
74	- No Token Expiration: Tokens should expire
75	- Client-Side Auth Checks Only: Always validate server-side
76	- Insecure Password Reset: Use secure tokens with expiration
77	- No Rate Limiting: Vulnerable to brute force
78	- Trusting Client Data: Always validate on server

People who liked this also viewed

6 picks

Type