mcpField
A
auth-implementation-patterns

auth-implementation-patterns

github.com/sickn33Security48.7k474 installsUpdated today
Repository

About auth-implementation-patterns

A skill for designing and implementing authentication and authorization in applications and APIs. It guides choices around identity flows, access policies, credential handling, and security testing, with a bundled playbook for detailed patterns.

Key features

  1. 01Choose authentication strategies
  2. 02Design authorization policies
  3. 03Plan secret storage and rotation
  4. 04Apply session and token practices
  5. 05Review security tests and limitations

Use cases

  1. 01Add authentication to an application
  2. 02Secure REST or GraphQL APIs
  3. 03Design OAuth2, SSO, or RBAC flows
  4. 04Debug session and authorization issues

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sickn33/agentic-awesome-skills --skill auth-implementation-patterns

After installing, type/auth-implementation-patternsin Claude Code to confirm it loaded.

Bundled filesresources/implementation-playbook.md

Details

From the project README

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

Use this skill when

  • Implementing user authentication systems
  • Securing REST or GraphQL APIs
  • Adding OAuth2/social login or SSO
  • Designing session management or RBAC
  • Debugging authentication or authorization issues

Do not use this skill when

  • You only need UI copy or login page styling
  • The task is infrastructure-only without identity concerns
  • You cannot change auth policies or credential storage

Instructions

  • Define users, tenants, flows, and threat model constraints.
  • Choose auth strategy (session, JWT, OIDC) and token lifecycle.
  • Design authorization model and policy enforcement points.
  • Plan secrets storage, rotation, logging, and audit requirements.
  • If detailed examples are required, open resources/implementation-playbook.md.

Safety

  • Never log secrets, tokens, or credentials.
  • Enforce least privilege and secure storage for keys.

Resources

  • resources/implementation-playbook.md for detailed patterns and examples.

Worked example

Input: an Express application accepts a user's login and keeps the pre-login session ID. Read the bundled playbook, regenerate the session after credential verification, save only required identity fields, and verify that the old cookie cannot access /api/profile. Also test failed login, logout and store failure. Expected: successful login changes the session ID; failed login grants no access.

Inputs and prerequisites

Record the installed framework/SDK versions, identity provider, tenant model, credential store and test environment. Supply project-specific database adapters and request schemas; examples are integration sketches, not a runnable identity service.

Limitations

  • JWT validation does not establish resource ownership; enforce tenant and object policy on reads and writes.
  • Refresh rotation requires atomic persistence and concurrency tests; the issuance example alone does not provide it.
  • Cookie flags do not replace CSRF protection, and secure-cookie behavior needs the actual HTTPS/proxy configuration tested.
  • Provider integrations and password policies must be checked against current primary documentation and the application's threat model.

Comments

Markdown supported