mcpField
A
auth-module-builder

auth-module-builder

github.com/patricio0312revSecurity63250 installsUpdated 41w ago
Repository

About auth-module-builder

A skill for implementing authentication modules, aimed at developers building web applications. It outlines routes, middleware, password handling, JWT or session patterns, and security checks against common threats.

Key features

  1. 01Define common authentication routes
  2. 02Add authentication middleware
  3. 03Hash and verify passwords with bcrypt
  4. 04Use JWT or stored sessions
  5. 05Apply cookie and CSRF protections
  6. 06Address common authentication threats

Use cases

  1. 01Build login and registration flows
  2. 02Add refresh and password-reset routes
  3. 03Store sessions with Redis or a database
  4. 04Review defenses for authentication endpoints

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/patricio0312rev/skills --skill auth-module-builder

After installing, type/auth-module-builderin Claude Code to confirm it loaded.

Details

From the project README

Auth Module Builder

Implement secure, production-ready authentication systems.

Core Components

Routes: POST /login, /register, /logout, /refresh, /forgot-password Middleware: authenticate, requireAuth, optionalAuth Security: bcrypt hashing, JWT signing, secure cookies, CSRF tokens Session: Redis/DB storage, expiration, refresh tokens Threats: Document common attacks and mitigations

JWT Pattern

// Generate tokens
const accessToken = jwt.sign(
  { userId: user.id, email: user.email },
  process.env.JWT_SECRET,
  { expiresIn: "15m" }
);

const refreshToken = jwt.sign(
  { userId: user.id, type: "refresh" },
  process.env.JWT_REFRESH_SECRET,
  { expiresIn: "7d" }
);

// Verify middleware
export const authenticate = async (req, res, next) => {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ error: "No token" });

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = await User.findById(decoded.userId);
    next();
  } catch (err) {
    res.status(401).json({ error: "Invalid token" });
  }
};

Session Pattern

// Express session with Redis
app.use(
  session({
    store: new RedisStore({ client: redisClient }),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      secure: process.env.NODE_ENV === "production",
      httpOnly: true,
      maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days
      sameSite: "lax",
    },
  })
);

Password Security

import bcrypt from "bcrypt";

// Hash password
const hashedPassword = await bcrypt.hash(password, 10);

// Verify password
const isValid = await bcrypt.compare(password, user.hashedPassword);

Security Checklist

  • Passwords hashed with bcrypt (cost ≥10)
  • JWT secrets from environment, rotated regularly
  • HTTPS only in production
  • httpOnly, secure cookies
  • CSRF protection enabled
  • Rate limiting on auth routes
  • Account lockout after failed attempts
  • Password reset tokens expire
  • Email verification for new accounts

Threat Model

Brute Force: Rate limit + account lockout Token Theft: Short expiry, httpOnly cookies, HTTPS only CSRF: SameSite cookies + CSRF tokens Session Fixation: Regenerate session ID on login XSS: Sanitize inputs, CSP headers

Comments

Markdown supported