auth-implementation-patterns

Implement JWT, OAuth2, and RBAC authentication patterns for web applications.

89|14|Updated Nov 15, 2025

Search Tags:#authorization #security #authentication #jwt #rbac #oauth2

Ready to run

npx skills add https://github.com/HermeticOrmus/LibreUIUX-Claude-Code --skill auth-implementation-patterns-hermeticormus

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-implementation-patterns
Source: https://github.com/HermeticOrmus/LibreUIUX-Claude-Code/tree/main/plugins/developer-essentials/skills/auth-implementation-patterns
Command: npx skills add https://github.com/HermeticOrmus/LibreUIUX-Claude-Code --skill auth-implementation-patterns-hermeticormus

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, express-session, passport, bcrypt, zod, rate-limit-redis, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides comprehensive solutions for implementing secure and scalable authentication and authorization systems, addressing common security vulnerabilities and complex access control requirements.

Core Features & Use Cases

Authentication Strategies: Implement session-based, JWT-based, and OAuth2/OpenID Connect flows.
Authorization Models: Utilize Role-Based Access Control (RBAC) and permission-based checks.
Security Best Practices: Enforce password security, rate limiting, and secure token management.
Use Case: Secure a new API endpoint by implementing JWT authentication and role-based access control to ensure only authorized users can access sensitive data.

Quick Start

Use the auth-implementation-patterns skill to generate JWT access and refresh tokens for a given user ID and role.

Frequently Asked Questions about auth-implementation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication and role-based access control in Express?▼

Implement JWT authentication in Express by generating access and refresh tokens using jsonwebtoken, validating them via middleware, and enforcing role-based access control (RBAC) by checking user roles before routing to sensitive API endpoints.

What's the best way to secure user passwords and manage credentials in a web application?▼

Secure user passwords by applying bcrypt hashing to credentials before storage. Validate credential payloads with zod schemas and enforce rate-limit-redis to prevent brute-force attacks during the authentication process.

Does this authentication approach support OAuth2 and session-based flows?▼

Yes, the authentication approach supports OAuth2 and OpenID Connect flows using passport strategies, alongside session-based authentication managed by express-session for secure access control in web applications.

How do I set up rate limiting for secure API endpoints?▼

Set up rate limiting for secure API endpoints by configuring rate-limit-redis to track and restrict incoming client requests, mitigating credential stuffing and brute-force vulnerabilities during the user login process.

When should I use JWT versus session-based authentication?▼

Use JWT for stateless, distributed API authentication where tokens carry user identity and roles, whereas session-based authentication via express-session is suited for stateful web applications requiring strict server-side access control.

How do I enforce resource ownership and permission-based checks?▼

Enforce resource ownership by validating the authenticated user's ID against the resource owner's ID, and apply permission-based checks within your RBAC implementation to restrict access to sensitive data based on user roles.