auth-implementation-patterns
Provides architectural guidance for implementing robust identity and access management patterns in software.
Install
mkdir -p .claude/skills/auth-implementation-patterns && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/4523" && unzip -o skill.zip -d .claude/skills/auth-implementation-patterns && rm skill.zipInstalls to .claude/skills/auth-implementation-patterns
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.Key capabilities
- →Implement JWT and OAuth2 flows
- →Design RBAC systems
- →Plan secure credential storage
- →Debug authentication issues
How it works
The skill guides users through defining threat models, choosing auth strategies, and designing policy enforcement points.
Inputs & outputs
When to use auth-implementation-patterns
- →Implementing JWT authentication
- →Setting up OAuth2 providers
- →Designing RBAC systems
About this skill
Authentication & Authorization Implementation Patterns
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
Use this skill when
- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login or SSO
- Designing session management or RBAC
- Debugging authentication or authorization issues
Do not use this skill when
- You only need UI copy or login page styling
- The task is infrastructure-only without identity concerns
- You cannot change auth policies or credential storage
Instructions
- Define users, tenants, flows, and threat model constraints.
- Choose auth strategy (session, JWT, OIDC) and token lifecycle.
- Design authorization model and policy enforcement points.
- Plan secrets storage, rotation, logging, and audit requirements.
- If detailed examples are required, open
resources/implementation-playbook.md.
Safety
- Never log secrets, tokens, or credentials.
- Enforce least privilege and secure storage for keys.
Resources
resources/implementation-playbook.mdfor detailed patterns and examples.
Worked example
Input: an Express application accepts a user's login and keeps the pre-login session ID. Read the bundled playbook, regenerate the session after credential verification, save only required identity fields, and verify that the old cookie cannot access /api/profile. Also test failed login, logout and store failure. Expected: successful login changes the session ID; failed login grants no access.
Inputs and prerequisites
Record the installed framework/SDK versions, identity provider, tenant model, credential store and test environment. Supply project-specific database adapters and request schemas; examples are integration sketches, not a runnable identity service.
Limitations
- JWT validation does not establish resource ownership; enforce tenant and object policy on reads and writes.
- Refresh rotation requires atomic persistence and concurrency tests; the issuance example alone does not provide it.
- Cookie flags do not replace CSRF protection, and secure-cookie behavior needs the actual HTTPS/proxy configuration tested.
- Provider integrations and password policies must be checked against current primary documentation and the application's threat model.
When not to use it
- →UI styling tasks
- →Infrastructure tasks without identity concerns
Limitations
- →Does not replace expert security review
- →Requires clear input parameters
How it compares
It provides structured implementation patterns for identity systems rather than generic security advice.
Compared to similar skills
auth-implementation-patterns side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| auth-implementation-patterns (this skill) | 1 | 5mo | No flags | Advanced |
| security-header-generator | 5 | 11mo | Caution | Intermediate |
| backend-security-coder | 24 | 5mo | No flags | Intermediate |
| security-best-practices | 7 | 8mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by sickn33
View all by sickn33 →You might also like
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-best-practices
openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
managing-api-cache
jeremylongshore
Implement intelligent API response caching with Redis, Memcached, and CDN integration. Use when optimizing API performance with caching. Trigger with phrases like "add caching", "optimize API performance", or "implement cache layer".
deserialization-testing
Ed1s0nZ
反序列化漏洞测试的专业技能和方法论
pipeline-plugin-development
TencentBlueKing
流水线插件开发完整指南，涵盖插件创建、task.json 配置规范、多语言开发示例（Python/Java/NodeJS/Golang）、输入输出规范、错误码规范、发布流程、调试方法。当用户需要开发蓝盾流水线插件、配置 task.json、处理插件输入输出或排查插件错误时使用。