skills.rest
yusoofsh
yusoofshCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-implementation-patterns

Implement secure authentication and RBAC authorization for REST and GraphQL APIs with JWT and OAuth2/OpenID Connect workflows.

Updated Aug 23, 2026
Search Tags:#authorization#security#authentication#access control#RBAC#session management#JWT#OAuth2
One-click install
npx skills add https://github.com/yusoofsh/dotfiles --skill auth-implementation-patterns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-implementation-patterns
Source: https://github.com/yusoofsh/dotfiles/tree/main/home/dot_claude/private_plugins/private_marketplaces/claude-code-workflows/plugins/developer-essentials/skills/auth-implementation-patterns
Command: npx skills add https://github.com/yusoofsh/dotfiles --skill auth-implementation-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, express-session, connect-redis, redis, passport, passport-google-oauth20, passport-github2, bcrypt, zod, express-rate-limit, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides proven patterns for implementing secure and scalable authentication and authorization, helping you protect user data and control access effectively across your applications.

Core Features & Use Cases

  • JWT & Refresh Tokens: Implement stateless authentication with short-lived access tokens and secure refresh token flows.
  • Session Management: Design traditional session-based authentication with secure cookie practices.
  • OAuth2/Social Login: Integrate third-party authentication providers like Google or GitHub.
  • RBAC & Permissions: Implement role-based and permission-based access control, including resource ownership.
  • Use Case: Secure a new web application with user registration, login, social sign-in, and ensure only authorized users can access specific features or data.

Quick Start

Use the auth-implementation-patterns skill to generate TypeScript code for generating and verifying JWTs, including a basic Express middleware for authentication.

Frequently Asked Questions about auth-implementation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication with refresh tokens in Express?▼

JWT authentication uses short-lived access tokens and refresh tokens to maintain stateless sessions. Generate tokens with jsonwebtoken, verify them in middleware, and rotate refresh tokens securely to balance security and user experience across REST APIs.

What's the best way to add OAuth2 social login to my application?▼

OAuth2 social login delegates authentication to providers like Google or GitHub using passport with passport-google-oauth20 or passport-github2. This eliminates password management on your side while giving users familiar sign-in options.

How do I implement role-based access control in my API?▼

RBAC enforces permissions by assigning roles to users and checking those roles before granting access to resources. Combine role checks with resource ownership validation in middleware to control which users can perform specific actions.

Can I combine session-based and token-based authentication?▼

Yes. Use express-session with connect-redis and redis for traditional session management, or use JWT tokens for stateless auth. Choose based on your scale and architecture—sessions suit monoliths; tokens scale better across distributed systems.

How do I secure password storage and prevent brute-force attacks?▼

Hash passwords with bcrypt during registration and verification. Prevent brute-force attacks using express-rate-limit to throttle login attempts by IP or user, raising the cost of automated attacks significantly.

What token lifecycle considerations matter for multi-tenant applications?▼

Multi-tenant auth requires token revocation, expiration policies, and tenant isolation. Design token issuance to include tenant context, implement revocation tracking, and enforce strict verification to prevent cross-tenant access.

Related Skills

Explore More Software Engineering Skills→
daniel-heydari-devdaniel-heydari-dev

Node.js Backend

Implement Node.js backend best practices with Express.js, Zod, JWT, and Pino.

Community
Advanced
TiepbmTiepbm

authn-authz-and-secrets

Design authentication, authorization, and secret management for enterprise systems.

Community
Advanced
Kushal9889Kushal9889

api-security-best-practices

Implements secure API authentication, authorization, input validation, rate limiting, and vulnerability protection.

Community
Advanced
utsavthakurutsavthakur

auth-sec

Analyze authentication and authorization workflows for OAuth, JWT, SAML, CORS, CSRF, and SSO weaknesses.

Community
Advanced