skills.rest
botPhU
botPhUCOMMUNITY
Explore all skills by this author →
GitHub

auth-expert

Guide JWT, OAuth 2.0, and RBAC implementation for application authentication.

Updated Dec 5, 2025
Search Tags:#authorization#RBAC#OAuth#session-management#JWT#authenticate#password-security
One-click install
npx skills add https://github.com/botPhU/project-An-English-speaking-practice-platform-supported-by-AI --skill auth-expert-botphu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-expert
Source: https://github.com/botPhU/project-An-English-speaking-practice-platform-supported-by-AI/tree/main/.agent/skills/auth-expert
Command: npx skills add https://github.com/botPhU/project-An-English-speaking-practice-platform-supported-by-AI --skill auth-expert-botphu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams implement robust authentication and authorization by providing expert guidance on JWT, OAuth 2.0, session management, RBAC, and password security. It reduces security risks, accelerates secure integration, and promotes best practices across applications.

Core Features & Use Cases

  • JWT implementation guidance: correct token generation, validation, rotation, and storage.
  • OAuth 2.0 patterns: authorization flows, PKCE, client management.
  • Session management: secure cookies, refresh tokens, idle timeouts.
  • RBAC & permissions: role definitions, least privilege enforcement, resource-level checks.
  • Password security: hashing, salting, algorithm recommendations.

Use cases: secure API authentication for microservices, protecting admin dashboards, enabling single sign-on, and auditing security controls.

Quick Start

Design a secure authentication and authorization plan for a REST API using JWT and OAuth 2.0, with RBAC and password hashing.

Frequently Asked Questions about auth-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication and OAuth 2.0 for a REST API?▼

Secure JWT authentication and OAuth 2.0 by applying correct token generation, validation, and rotation processes alongside authorization flows. This establishes secure token management and access control for API backends and microservices.

What is the best way to define RBAC permissions and enforce least privilege?▼

Define RBAC permissions by establishing role definitions and enforcing least privilege through resource-level access checks. This secures admin dashboards and microservices by restricting access strictly to necessary resources.

How does session management work with refresh tokens and secure cookies?▼

Session management with refresh tokens and secure cookies works by handling idle timeouts and token rotation. This maintains secure user onboarding and persistent application sessions without exposing valid credentials.

What are the recommended algorithms for password hashing and salting?▼

Recommended password hashing and salting algorithms provide cryptographically secure methods for protecting user credentials. Using these algorithms ensures passwords remain protected against brute force attacks during storage and verification.

Do I need PKCE for OAuth 2.0 authorization flows in single sign-on?▼

PKCE is needed for OAuth 2.0 authorization flows to protect single sign-on integrations. It prevents authorization code interception attacks by requiring dynamic client validation during the token exchange process.

When should I use token rotation instead of long-lived JWTs?▼

Use token rotation instead of long-lived JWTs when managing active sessions requiring frequent access validation. Token rotation limits the exposure window of compromised credentials by issuing new tokens and revoking previous ones.

Related Skills

Explore More Software Engineering Skills→
grasberggrasberg
3

backend-specialist

Automate backend design and implementation for Node.js, Python, or Go systems.

Community
Advanced
langbyyilangbyyi
96

jwt-oauth-token-attacks

Identify and exploit JWT and OAuth 2.0 authentication vulnerabilities.

Community
Advanced
briannadoubtbriannadoubt

security

Enforce authentication, authorization, rate limiting, and request validation for Trebuchet actors.

Community
Advanced
mjunaidcamjunaidca
27

better-auth-setup

Configures Better Auth OIDC Provider with PKCE and JWKS for centralized SSO.

Community
Advanced