0127-auth-implementation-patterns

What problem does it solve?

This Skill helps you implement and troubleshoot authentication and authorization so your APIs and apps remain secure, scalable, and correctly permissioned.

Core Features & Use Cases

• JWT + Refresh Token Flows: Issue short-lived access tokens, refresh them safely, and revoke sessions by storing and hashing refresh tokens.
• Session-Based Auth: Use server sessions (often backed by Redis) with secure cookie settings and middleware-protected routes.
• OAuth2 / OIDC Social Login: Delegate login to providers (e.g., Google/GitHub/enterprise SSO) and map provider identities to users.
• Authorization Controls: Enforce RBAC, permission-based checks, and resource ownership rules to prevent unauthorized actions.
• Security Best Practices: Apply rate limiting, password hashing/validation, HTTPS/cookie protections, and robust token validation.

Quick Start

Use this Skill to design an end-to-end JWT access/refresh authentication flow with RBAC-enforced authorization for protected REST routes in an Express API.