Master authentication and authorization patterns including

Authentication & Authorization Implementation Patterns

by wshobson · MIT license · ★ 39,857 on GitHub · updated Sep 21

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

---
name: auth-implementation-patterns
description: Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
---

# Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

## When to Use This Skill

- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login
- Implementing role-based access control (RBAC)
- Designing session management
- Migrating authentication systems
- Debugging auth issues

Overview

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

Manual install (npx, ZIP)

Claude Codenpx skills add wshobson/agents --skill auth-implementation-patterns -g -a claude-code

Claude Code (manual)

mkdir -p ~/.claude/skills && curl -sL https://codeload.github.com/wshobson/agents/tar.gz/4236bb91f839 \
  | tar -xz -C ~/.claude/skills --strip-components=4 agents-4236bb91f839/plugins/developer-essentials/skills/auth-implementation-patterns

Windows (PowerShell)

New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Invoke-WebRequest "https://m.agentalley.io/zip/807f5f8eaf1535e57b6b/auth-implementation-patterns.zip" -OutFile "$env:TEMP\auth-implementation-patterns.zip"; Expand-Archive "$env:TEMP\auth-implementation-patterns.zip" -DestinationPath "$HOME\.claude\skills" -Force

Claude.ai / desktopDownload the ZIP and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md2.6 KB
references/1 file · 13.4 KB

Read the files here

wshobson/4236bb92 files

SKILL.md2.6 KB

SKILL.md

Show the full text84 lines

auth-implementation-patterns/SKILL.md84 lines · 2.6 KB

PreviewCode

Outline

RawView on GitHub

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

Implementing user authentication systems
Securing REST or GraphQL APIs
Adding OAuth2/social login
Implementing role-based access control (RBAC)
Designing session management
Migrating authentication systems
Debugging auth issues
Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

Verifying identity (username/password, OAuth, biometrics)
Issuing credentials (sessions, tokens)
Managing login/logout

Authorization (AuthZ): What can you do?

Permission checking
Role-based access control (RBAC)
Resource ownership validation
Policy enforcement

2. Authentication Strategies

Session-Based:

Server stores session state
Session ID in cookie
Traditional, simple, stateful

Token-Based (JWT):

Stateless, self-contained
Scales horizontally
Can store claims

OAuth2/OpenID Connect:

Delegate authentication
Social login (Google, GitHub)
Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

Never Store Plain Passwords: Always hash with bcrypt/argon2
Use HTTPS: Encrypt data in transit
Short-Lived Access Tokens: 15-30 minutes max
Secure Cookies: httpOnly, secure, sameSite flags
Validate All Input: Email format, password strength
Rate Limit Auth Endpoints: Prevent brute force attacks
Implement CSRF Protection: For session-based auth
Rotate Secrets Regularly: JWT secrets, session secrets
Log Security Events: Login attempts, failed auth
Use MFA When Possible: Extra security layer

Common Pitfalls

Weak Passwords: Enforce strong password policies
JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
No Token Expiration: Tokens should expire
Client-Side Auth Checks Only: Always validate server-side
Insecure Password Reset: Use secure tokens with expiration
No Rate Limiting: Vulnerable to brute force
Trusting Client Data: Always validate on server

1	---
2	name: auth-implementation-patterns
3	description: Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
4	---
5
6	# Authentication & Authorization Implementation Patterns
7
8	Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
9
10	## When to Use This Skill
11
12	- Implementing user authentication systems
13	- Securing REST or GraphQL APIs
14	- Adding OAuth2/social login
15	- Implementing role-based access control (RBAC)
16	- Designing session management
17	- Migrating authentication systems
18	- Debugging auth issues
19	- Implementing SSO or multi-tenancy
20
21	## Core Concepts
22
23	### 1. Authentication vs Authorization
24
25	Authentication (AuthN): Who are you?
26
27	- Verifying identity (username/password, OAuth, biometrics)
28	- Issuing credentials (sessions, tokens)
29	- Managing login/logout
30
31	Authorization (AuthZ): What can you do?
32
33	- Permission checking
34	- Role-based access control (RBAC)
35	- Resource ownership validation
36	- Policy enforcement
37
38	### 2. Authentication Strategies
39
40	Session-Based:
41
42	- Server stores session state
43	- Session ID in cookie
44	- Traditional, simple, stateful
45
46	Token-Based (JWT):
47
48	- Stateless, self-contained
49	- Scales horizontally
50	- Can store claims
51
52	OAuth2/OpenID Connect:
53
54	- Delegate authentication
55	- Social login (Google, GitHub)
56	- Enterprise SSO
57
58	## Detailed patterns and worked examples
59
60	Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
61
62	## Best Practices
63
64	1. Never Store Plain Passwords: Always hash with bcrypt/argon2
65	2. Use HTTPS: Encrypt data in transit
66	3. Short-Lived Access Tokens: 15-30 minutes max
67	4. Secure Cookies: httpOnly, secure, sameSite flags
68	5. Validate All Input: Email format, password strength
69	6. Rate Limit Auth Endpoints: Prevent brute force attacks
70	7. Implement CSRF Protection: For session-based auth
71	8. Rotate Secrets Regularly: JWT secrets, session secrets
72	9. Log Security Events: Login attempts, failed auth
73	10. Use MFA When Possible: Extra security layer
74
75	## Common Pitfalls
76
77	- Weak Passwords: Enforce strong password policies
78	- JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
79	- No Token Expiration: Tokens should expire
80	- Client-Side Auth Checks Only: Always validate server-side
81	- Insecure Password Reset: Use secure tokens with expiration
82	- No Rate Limiting: Vulnerable to brute force
83	- Trusting Client Data: Always validate on server
84