Auth implementation patterns

Skill bg-szy/TOP-SKILLS/skills/awesome-skills/auth-implementation-patterns

全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard

Install

npx -y skills add bg-szy/TOP-SKILLS --skill auth-implementation-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

SKILL.md

2.6 KB, as published. Nobody here has run it

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

Implementing user authentication systems
Securing REST or GraphQL APIs
Adding OAuth2/social login
Implementing role-based access control (RBAC)
Designing session management
Migrating authentication systems
Debugging auth issues
Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

Verifying identity (username/password, OAuth, biometrics)
Issuing credentials (sessions, tokens)
Managing login/logout

Authorization (AuthZ): What can you do?

Permission checking
Role-based access control (RBAC)
Resource ownership validation
Policy enforcement

2. Authentication Strategies

Session-Based:

Server stores session state
Session ID in cookie
Traditional, simple, stateful

Token-Based (JWT):

Stateless, self-contained
Scales horizontally
Can store claims

OAuth2/OpenID Connect:

Delegate authentication
Social login (Google, GitHub)
Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

Never Store Plain Passwords: Always hash with bcrypt/argon2
Use HTTPS: Encrypt data in transit
Short-Lived Access Tokens: 15-30 minutes max
Secure Cookies: httpOnly, secure, sameSite flags
Validate All Input: Email format, password strength
Rate Limit Auth Endpoints: Prevent brute force attacks
Implement CSRF Protection: For session-based auth
Rotate Secrets Regularly: JWT secrets, session secrets
Log Security Events: Login attempts, failed auth
Use MFA When Possible: Extra security layer

Common Pitfalls

Weak Passwords: Enforce strong password policies
JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
No Token Expiration: Tokens should expire
Client-Side Auth Checks Only: Always validate server-side
Insecure Password Reset: Use secure tokens with expiration
No Rate Limiting: Vulnerable to brute force
Trusting Client Data: Always validate on server