skills.rest
MrJmpl3
MrJmpl3COMMUNITY
Explore all skills by this author →
𝕏@MrJmpl3GitHub

0127-auth-implementation-patterns

Implement JWT, OAuth2, session, and RBAC authentication for web APIs.

Updated Aug 23, 2026
Search Tags:#authorization#authentication#jwt#rbac#session management#oauth2#security middleware
One-click install
npx skills add https://github.com/MrJmpl3/codex_____data_____configuration --skill 0127-auth-implementation-patterns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: 0127-auth-implementation-patterns
Source: https://github.com/MrJmpl3/codex_____data_____configuration/tree/main/skills/0127-auth-implementation-patterns
Command: npx skills add https://github.com/MrJmpl3/codex_____data_____configuration --skill 0127-auth-implementation-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you implement and troubleshoot authentication and authorization so your APIs and apps remain secure, scalable, and correctly permissioned.

Core Features & Use Cases

  • JWT + Refresh Token Flows: Issue short-lived access tokens, refresh them safely, and revoke sessions by storing and hashing refresh tokens.
  • Session-Based Auth: Use server sessions (often backed by Redis) with secure cookie settings and middleware-protected routes.
  • OAuth2 / OIDC Social Login: Delegate login to providers (e.g., Google/GitHub/enterprise SSO) and map provider identities to users.
  • Authorization Controls: Enforce RBAC, permission-based checks, and resource ownership rules to prevent unauthorized actions.
  • Security Best Practices: Apply rate limiting, password hashing/validation, HTTPS/cookie protections, and robust token validation.

Quick Start

Use this Skill to design an end-to-end JWT access/refresh authentication flow with RBAC-enforced authorization for protected REST routes in an Express API.

Frequently Asked Questions about 0127-auth-implementation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT access and refresh token flows for a REST API?▼

Implement JWT authentication by issuing short-lived access tokens, storing hashed refresh tokens safely, and revoking sessions upon expiration to secure REST API endpoints against unauthorized access.

What is the best way to enforce RBAC and resource ownership rules in web applications?▼

Enforce RBAC authorization by applying security middleware that checks user roles and permissions, validating resource ownership constraints to prevent unauthorized actions and returning proper 403 responses for forbidden requests.

How does OAuth2 social login integration work with existing user identities?▼

OAuth2 social login delegates authentication to external providers like Google or GitHub, mapping provider identities to existing application users so they can securely access protected routes via single sign-on.

Can I use session-based authentication with secure cookies instead of JWT tokens?▼

Session-based authentication uses server-side sessions backed by stores like Redis with secure cookie settings, providing middleware-protected routes as an alternative to stateless JWT token-based access management.

Why does my authorization middleware return a 401 instead of a 403 status code?▼

Authorization middleware returns 401 for missing or invalid authentication tokens, while 403 indicates the authenticated user lacks the necessary RBAC permissions or resource ownership rights required to access the endpoint.

How do I securely handle token expiration and refresh token revocation?▼

Handle token expiration by verifying short-lived access tokens and refreshing them safely, while storing hashed refresh tokens server-side to enable immediate session revocation and prevent security breaches.

Related Skills

Explore More Software Engineering Skills→
Haseeb-ArshadHaseeb-Arshad
2

senior-backend

Design scalable REST APIs and backend services for Node.js environments.

Community
Advanced
AgentiveCityAgentiveCity
2

cloudflare-security-hardening

Configure WAF rules, rate limiting, IP lists, and secure headers for Cloudflare Workers APIs.

Official
Advanced
hung-phanhung-phan

authn

Analyze authentication designs for password hashing, MFA, and session management.

Community
Advanced
markus41markus41
1

authentication

Implement JWT, OAuth2, sessions, and RBAC for authentication and authorization.

Community
Intermediate