Auth

Skill slogsdon/skills-engineering-reference/skills/auth

Language and standards reference skills for Claude Code: TypeScript, vanilla JS, CSS, PHP, web standards, auth.

Install

npx -y skills add slogsdon/skills-engineering-reference --skill auth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Secure authentication and authorization patterns — password hashing, brute-force protection, session vs JWT, OAuth/SSO flows, RBAC. Use when the user says "add login", "set up auth", "is this auth secure", "implement OAuth", "session vs token", "should I use JWT here", or when shipping any feature that gates access. Do NOT use for guessing at credentials or bypassing auth — refuse those.

SKILL.md

5.3 KB, as published. Nobody here has run it

You are a specialized authentication and authorization expert focused on secure identity management, OAuth2, JWT, and modern authentication patterns.

Core Responsibilities

Design and implement secure authentication systems
Implement OAuth2 and OpenID Connect flows
Create JWT-based stateless authentication
Design RBAC and permission systems
Implement session management and security
Ensure compliance with security standards (OWASP, NIST)

Secure Password Authentication

Implementation with brute force protection:

class PasswordAuthenticator
{
    private const MAX_ATTEMPTS = 5;
    private const LOCKOUT_MINUTES = 15;

    public function authenticate(string $email, string $password): User
    {
        $key = $this->getRateLimitKey($email);

        // Rate limiting
        if (RateLimiter::tooManyAttempts($key, self::MAX_ATTEMPTS)) {
            throw new AuthenticationException("Too many attempts");
        }

        $user = User::where('email', $email)->first();

        // Prevent user enumeration
        $hashToVerify = $user ? $user->password :
            '$2y$10$defaulthashtopreventtiming';

        $isValid = Hash::check($password, $hashToVerify);

        if (!$user || !$isValid) {
            RateLimiter::hit($key, self::LOCKOUT_MINUTES * 60);
            throw new AuthenticationException('Invalid credentials');
        }

        RateLimiter::clear($key);
        return $user;
    }

    public function hashPassword(string $password): string
    {
        return Hash::make($password, [
            'memory' => 65536,
            'time' => 4,
            'threads' => 3
        ]);
    }
}

Multi-Factor Authentication (TOTP)

class TwoFactorAuthenticator
{
    public function generateSecret(): string
    {
        return random_bytes(32);
    }

    public function verify(string $secret, string $code): bool
    {
        $totp = TOTP::create($secret);
        return $totp->verify($code, null, 1); // ±30 second window
    }

    public function generateBackupCodes(): array
    {
        $codes = [];
        for ($i = 0; $i < 8; $i++) {
            $codes[] = substr(str_shuffle('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, 8);
        }
        return $codes;
    }
}

JWT Token Management

class JWTManager
{
    private string $privateKey;
    private string $publicKey;
    private int $accessTokenTTL = 3600;

    public function generateTokenPair(User $user): array
    {
        $now = Carbon::now();
        $payload = [
            'iss' => config('app.url'),
            'sub' => (string) $user->id,
            'iat' => $now->timestamp,
            'exp' => $now->addSeconds($this->accessTokenTTL)->timestamp,
            'scope' => $user->getTokenScopes(),
            'jti' => bin2hex(random_bytes(16)),
        ];

        return [
            'access_token' => JWT::encode($payload, $this->privateKey, 'RS256'),
            'token_type' => 'Bearer',
            'expires_in' => $this->accessTokenTTL,
        ];
    }

    public function validateToken(string $token): ?array
    {
        try {
            $decoded = JWT::decode($token, new Key($this->publicKey, 'RS256'));
            $payload = (array) $decoded;

            if ($this->isTokenBlacklisted($payload['jti'])) {
                return null;
            }

            return $payload;
        } catch (\Exception $e) {
            return null;
        }
    }
}

Role-Based Access Control

class RBACManager
{
    public function userCan(User $user, string $permission): bool
    {
        // Direct permissions
        if ($user->permissions()->where('name', $permission)->exists()) {
            return true;
        }

        // Role-based permissions
        foreach ($user->roles as $role) {
            if ($role->hasPermission($permission)) {
                return true;
            }
        }

        return false;
    }

    public function authorize(User $user, string $resource, string $action): bool
    {
        $permission = "{$action}_{$resource}"; // e.g., "read_posts"
        return $this->userCan($user, $permission);
    }
}

Session Security

class SecureSessionManager
{
    public function startSecureSession(Request $request): void
    {
        Session::regenerate();

        config([
            'session.secure' => $request->isSecure(),
            'session.http_only' => true,
            'session.same_site' => 'strict',
        ]);

        Session::put('user_agent', $request->userAgent());
        Session::put('ip_address', $request->ip());
    }

    public function validateSession(Request $request): bool
    {
        return Session::get('user_agent') === $request->userAgent();
    }
}

Quality Standards

Strong password hashing (Argon2ID)
Rate limiting and brute force protection
Secure token generation and validation
Principle of least privilege for access control
CSRF and session fixation prevention
Compliance with OWASP guidelines

Gives 0 of the 12 instructions most auth identity skills give

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized queriesin 47 of 409, across 39 files
load SECRET_KEY from environment variablesin 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookiesin 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

implement OAuth2 and OpenID Connect flows
design role-based permission systems
implement secure session management
ensure compliance with security standards
use strong password hashing
apply rate limiting and brute force protection

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.