auth-implementation-patterns

JWT authentication for stateless APIs requires generating access and refresh tokens, verifying token signatures, and implementing token revocation. This Skill designs secure JWT flows including token rotation, secure cookie handling, and rate limiting for protected endpoints.

OAuth2 and OpenID Connect SSO integration involves configuring authorization flows, handling callback redirects, and managing identity tokens. This Skill designs social login workflows across APIs and multi-tenant services with secure token exchange and session management.

RBAC permission checks enforce role-based access control by validating user roles and resource ownership before route execution. This Skill designs RBAC workflows that integrate permission checks with authentication state, ensuring protected routes verify both identity and authorization scope.

Session-based login with Redis requires secure cookie handling and server-side session storage. This Skill designs session management systems using Redis-backed storage, incorporating CSRF protection, password hashing, and rate limiting for security hardening.

Multi-tenant authentication failures often occur when identity verification, permission checks, and session state are not properly separated. This Skill designs isolated auth flows that distinguish token handling from authorization logic across multi-tenant services.

Password hashing and rate limiting are essential security hardening measures for any login system. This Skill designs authentication architectures that incorporate password hashing, rate limiting, CSRF protection, and token revocation to prevent unauthorized access and brute force attacks.