auth-implementation-patterns

Implement JWT authentication by generating access and refresh tokens using TypeScript. This Skill provides code examples for stateless token-based authentication, covering secure token generation, validation, and refresh workflows using jsonwebtoken.

Role-Based Access Control (RBAC) for API security works by enforcing granular permissions based on user roles. This Skill guides you in implementing RBAC models and permission-based checks to restrict access to specific API endpoints and resources.

Secure OAuth2 sessions using Passport and Redis by storing session data with connect-redis. This Skill covers OAuth2/OpenID Connect strategies using passport-google-oauth20 and passport-github2, alongside secure session handling mechanisms.

Yes, you can use bcrypt and zod for password hashing and validation in your auth system. This Skill includes security best practices for password hashing with bcrypt and input validation with zod to ensure robust access control.

Apply rate limiting to protect authentication endpoints using express-rate-limit and rate-limit-redis. This Skill provides patterns for integrating Redis-backed rate limiting to prevent brute-force attacks and API security abuse.

Use stateless JWT tokens for scalable, decoupled API architectures and session-based authentication for server-rendered web applications requiring immediate session revocation. This Skill covers both strategies, addressing implementation depth and secure session handling.