auth-hardening

Implement authentication hardening with password policies, MFA, and session security.

15|Updated May 12, 2026

Search Tags:#security #authentication #oauth #session management #mfa #password policy

Ready to run

npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill auth-hardening

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-hardening
Source: https://github.com/GoldenWing-360/claude-security-skills/tree/main/auth-hardening
Command: npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill auth-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Password-related vulnerabilities and insecure authentication practices put digital accounts at risk, enabling unauthorized access and breaches.

Core Features & Use Cases

Implement secure password policies aligned with industry standards to prevent weak credential usage.
Enforce multi-factor authentication including WebAuthn and TOTP for sensitive and administrative accounts.
Optimize session management with server-side cookies versus JWT, ensuring secure, revocable user sessions.
Secure OAuth integrations by requesting minimal scopes, verifying tokens, and preventing CSRF attacks.
Design robust account recovery and locking mechanisms that prevent user enumeration while thwarting brute-force attacks.

Quick Start

Follow best practices outlined in this skill to upgrade your authentication system for enhanced security and compliance.

Frequently Asked Questions about auth-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement secure session management using server-side cookies versus JWT?▼

Secure session management using server-side cookies versus JWT requires optimizing token verification and ensuring revocable user sessions. It establishes best practices for validating tokens to prevent credential theft and abuse in web applications.

What's the best way to enforce multi-factor authentication with WebAuthn and TOTP?▼

Enforcing multi-factor authentication with WebAuthn and TOTP protects sensitive and administrative accounts from compromise. This Skill provides industry-aligned validation techniques to integrate these MFA methods and prevent unauthorized access.

How does OAuth integration prevent CSRF attacks and secure token verification?▼

OAuth integration prevents CSRF attacks and secures token verification by requesting minimal scopes and validating tokens. This Skill outlines standards-based practices to secure OAuth integrations and protect user identities from abuse.

How do I design account lockout strategies that prevent user enumeration during brute-force attacks?▼

Designing account lockout strategies that prevent user enumeration during brute-force attacks requires robust recovery mechanisms. This Skill addresses abuse mitigation techniques to thwart brute-force attempts without exposing valid user data.

What password policies align with industry standards to prevent weak credential usage?▼

Password policies aligned with industry standards prevent weak credential usage and credential theft. This Skill establishes best practices for modern authentication standards to ensure secure password validation and data protection.