Auth Implementation Guide

/auth-implementation-patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices. Deliver working auth code and configuration as chat artifacts in the user's stack; ask the user to paste their existing auth code and framework details when debugging.

When to Use This Skill

• Implementing user authentication systems
• Securing REST or GraphQL APIs
• Adding OAuth2/social login
• Implementing role-based access control (RBAC)
• Designing session management
• Migrating authentication systems
• Debugging auth issues
• Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

• Verifying identity (username/password, OAuth, biometrics)
• Issuing credentials (sessions, tokens)
• Managing login/logout

Authorization (AuthZ): What can you do?

• Permission checking
• Role-based access control (RBAC)
• Resource ownership validation
• Policy enforcement

2. Authentication Strategies

Session-Based:

• Server stores session state
• Session ID in cookie
• Traditional, simple, stateful
• Revocation is trivial (delete the session); best default for server-rendered apps

Token-Based (JWT):

• Stateless, self-contained
• Scales horizontally
• Can store claims
• Pair short-lived access tokens with refresh tokens; plan a revocation strategy (denylist or token versioning)

OAuth2/OpenID Connect:

• Delegate authentication
• Social login (Google, GitHub)
• Enterprise SSO
• Use the Authorization Code flow with PKCE for public clients; validate state and nonce

3. Authorization Patterns

• RBAC: users have roles; roles grant permissions. Check permissions, not role names, at enforcement points so roles can evolve.
• Resource ownership: verify the authenticated principal owns or is granted the specific resource on every request (WHERE user_id = ?), never trusting IDs from the client alone.
• Policy enforcement: centralize checks in middleware/guards rather than scattering conditionals through handlers.

Best Practices

1. Never Store Plain Passwords: always hash with bcrypt/argon2
2. Use HTTPS: encrypt data in transit
3. Short-Lived Access Tokens: 15-30 minutes max
4. Secure Cookies: httpOnly, secure, sameSite flags
5. Validate All Input: email format, password strength
6. Rate Limit Auth Endpoints: prevent brute force attacks
7. Implement CSRF Protection: for session-based auth
8. Rotate Secrets Regularly: JWT secrets, session secrets
9. Log Security Events: login attempts, failed auth
10. Use MFA When Possible: extra security layer

Common Pitfalls

• Weak Passwords: enforce strong password policies
• JWT in localStorage: vulnerable to XSS; use httpOnly cookies
• No Token Expiration: tokens should expire
• Client-Side Auth Checks Only: always validate server-side
• Insecure Password Reset: use secure tokens with expiration
• No Rate Limiting: vulnerable to brute force
• Trusting Client Data: always validate on the server

Deliverables

When implementing auth in chat, produce as artifacts:

• The auth flow diagram or step list (login, refresh, logout, reset)
• Server code: registration/login handlers, middleware/guards, token or session issuance
• Configuration: cookie flags, token lifetimes, hashing parameters, environment variable names (never actual secrets)
• A test checklist covering the failure paths: expired token, revoked session, wrong role, replayed refresh token

Usage

/auth-implementation-patterns $ARGUMENTS