skilld
All skills
wshobson avatar

/auth-implementation-patterns

@be57c0b
by Seth Hobsonwshobson/agents40k stars
4,281

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Ask your Agent

Use this Skill: https://skilld.dev/gh/wshobson/agents/auth-implementation-patterns

This session only. Nothing lands on disk.

SKILL.md

≈65 tokens always: the name and description. ≈597 when used: this file. ≈3.4k more on demand in 1 file.

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

  • Implementing user authentication systems
  • Securing REST or GraphQL APIs
  • Adding OAuth2/social login
  • Implementing role-based access control (RBAC)
  • Designing session management
  • Migrating authentication systems
  • Debugging auth issues
  • Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

  • Verifying identity (username/password, OAuth, biometrics)
  • Issuing credentials (sessions, tokens)
  • Managing login/logout

Authorization (AuthZ): What can you do?

  • Permission checking
  • Role-based access control (RBAC)
  • Resource ownership validation
  • Policy enforcement

2. Authentication Strategies

Session-Based:

  • Server stores session state
  • Session ID in cookie
  • Traditional, simple, stateful

Token-Based (JWT):

  • Stateless, self-contained
  • Scales horizontally
  • Can store claims

OAuth2/OpenID Connect:

  • Delegate authentication
  • Social login (Google, GitHub)
  • Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

  1. Never Store Plain Passwords: Always hash with bcrypt/argon2
  2. Use HTTPS: Encrypt data in transit
  3. Short-Lived Access Tokens: 15-30 minutes max
  4. Secure Cookies: httpOnly, secure, sameSite flags
  5. Validate All Input: Email format, password strength
  6. Rate Limit Auth Endpoints: Prevent brute force attacks
  7. Implement CSRF Protection: For session-based auth
  8. Rotate Secrets Regularly: JWT secrets, session secrets
  9. Log Security Events: Login attempts, failed auth
  10. Use MFA When Possible: Extra security layer

Common Pitfalls

  • Weak Passwords: Enforce strong password policies
  • JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
  • No Token Expiration: Tokens should expire
  • Client-Side Auth Checks Only: Always validate server-side
  • Insecure Password Reset: Use secure tokens with expiration
  • No Rate Limiting: Vulnerable to brute force
  • Trusting Client Data: Always validate on server

Source: SKILL.md on GitHub

Third-party checks

1 warning16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides secure, industry-standard implementation patterns for authentication and authorization. It includes well-documented examples for JWTs, sessions, OAuth2, and RBAC using reputable libraries. No security risks were detected.

  • Socket16d

    1 alert: gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    1 file scanned · No issues

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at be57c0b. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 3 days ago.

Activeupdated 4 months ago

Topics

  • authentication
  • authorization
  • jwt
  • oauth2
  • session-management
  • rbac
  • api-security
  • password-hashing
  • sso
  • multi-tenancy

README badge

README badge for wshobson/agents/auth-implementation-patterns

What it does

Teaches authentication and authorization patterns including JWT, OAuth2, session management, and RBAC for building secure access control systems. Covers implementation strategies for REST/GraphQL APIs, social login, role-based permissions, and common security pitfalls like weak password policies and client-side-only validation.

Generated from the current SKILL.md.

Frequently asked

Does this skill cover specific OAuth2 providers like Google or GitHub?
The skill teaches OAuth2 and OpenID Connect patterns and mentions social login examples, but focuses on general implementation principles rather than provider-specific setup.
What password hashing algorithms does this skill recommend?
The skill recommends bcrypt and argon2 for hashing passwords, and emphasizes never storing plain passwords.
Does this cover JWT token refresh patterns?
The skill mentions short-lived access tokens (15-30 minutes max) and secret rotation, but detailed refresh token patterns are referenced in the `references/details.md` file.
Does this skill address multi-tenancy or SSO?
The skill lists multi-tenancy and SSO as use cases where the skill applies, but the core content focuses on foundational auth patterns rather than tenant isolation specifics.

Generated from the current SKILL.md. These answers refresh after source changes.