Authentication & Authorization Implementation Patterns
Unverified●30/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add auth-implementation-patternsWho is stuck, and on what
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
The whole source
Frontmatter — 2 properties
| name | auth-implementation-patterns |
|---|---|
| description | Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues. |
| 1 | --- |
| 2 | name: auth-implementation-patterns |
| 3 | description: Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # Authentication & Authorization Implementation Patterns |
| 7 | |
| 8 | Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices. |
| 9 | |
| 10 | ## When to Use This Skill |
| 11 | |
| 12 | - Implementing user authentication systems |
| 13 | - Securing REST or GraphQL APIs |
| 14 | - Adding OAuth2/social login |
| 15 | - Implementing role-based access control (RBAC) |
| 16 | - Designing session management |
| 17 | - Migrating authentication systems |
| 18 | - Debugging auth issues |
| 19 | - Implementing SSO or multi-tenancy |
| 20 | |
| 21 | ## Core Concepts |
| 22 | |
| 23 | ### 1. Authentication vs Authorization |
| 24 | |
| 25 | **Authentication (AuthN)**: Who are you? |
| 26 | |
| 27 | - Verifying identity (username/password, OAuth, biometrics) |
| 28 | - Issuing credentials (sessions, tokens) |
| 29 | - Managing login/logout |
| 30 | |
| 31 | **Authorization (AuthZ)**: What can you do? |
| 32 | |
| 33 | - Permission checking |
| 34 | - Role-based access control (RBAC) |
| 35 | - Resource ownership validation |
| 36 | - Policy enforcement |
| 37 | |
| 38 | ### 2. Authentication Strategies |
| 39 | |
| 40 | **Session-Based:** |
| 41 | |
| 42 | - Server stores session state |
| 43 | - Session ID in cookie |
| 44 | - Traditional, simple, stateful |
| 45 | |
| 46 | **Token-Based (JWT):** |
| 47 | |
| 48 | - Stateless, self-contained |
| 49 | - Scales horizontally |
| 50 | - Can store claims |
| 51 | |
| 52 | **OAuth2/OpenID Connect:** |
| 53 | |
| 54 | - Delegate authentication |
| 55 | - Social login (Google, GitHub) |
| 56 | - Enterprise SSO |
| 57 | |
| 58 | ## Detailed patterns and worked examples |
| 59 | |
| 60 | Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient. |
| 61 | |
| 62 | ## Best Practices |
| 63 | |
| 64 | 1. **Never Store Plain Passwords**: Always hash with bcrypt/argon2 |
| 65 | 2. **Use HTTPS**: Encrypt data in transit |
| 66 | 3. **Short-Lived Access Tokens**: 15-30 minutes max |
| 67 | 4. **Secure Cookies**: httpOnly, secure, sameSite flags |
| 68 | 5. **Validate All Input**: Email format, password strength |
| 69 | 6. **Rate Limit Auth Endpoints**: Prevent brute force attacks |
| 70 | 7. **Implement CSRF Protection**: For session-based auth |
| 71 | 8. **Rotate Secrets Regularly**: JWT secrets, session secrets |
| 72 | 9. **Log Security Events**: Login attempts, failed auth |
| 73 | 10. **Use MFA When Possible**: Extra security layer |
| 74 | |
| 75 | ## Common Pitfalls |
| 76 | |
| 77 | - **Weak Passwords**: Enforce strong password policies |
| 78 | - **JWT in localStorage**: Vulnerable to XSS, use httpOnly cookies |
| 79 | - **No Token Expiration**: Tokens should expire |
| 80 | - **Client-Side Auth Checks Only**: Always validate server-side |
| 81 | - **Insecure Password Reset**: Use secure tokens with expiration |
| 82 | - **No Rate Limiting**: Vulnerable to brute force |
| 83 | - **Trusting Client Data**: Always validate on server |
| 84 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Subagent Driven DevelopmentUse when executing implementation plans with independent tasks in the current session◐◐◐◐◐●36/40Python Code Style & DocumentationPython code style, linting, formatting, naming conventions, and documentation standards. Use when writing new code, reviewing style, configuring linters, writing docstrings, or establishing project standards.◐····●35/40Competitor Price Analysis 💲Competitor pricing strategy analysis and market positioning. Price mapping, pricing gaps identification, elasticity signals evaluation, and strategic pricing optimization. Use when the user asks about competitor pricing, price analysis, pricing strategy, or co◐····●34/40Competitor Price Tracker 📊Set up competitor price tracking and monitoring workflows. Track price changes, detect promotions, analyze pricing patterns, and get alerts for competitive price movements.◐····●34/40