skills.rest
maxjuniorbr
maxjuniorbrCOMMUNITY
Explore all skills by this author →
GitHub

auth-implementation-patterns

Implement JWT authentication with rotating refresh tokens and RBAC for SegFlow CRM.

2|Updated Nov 21, 2025
Search Tags:#authorization#authentication#jwt#rbac#sessions#oauth2
One-click install
npx skills add https://github.com/maxjuniorbr/segflow-crm --skill auth-implementation-patterns-maxjuniorbr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-implementation-patterns
Source: https://github.com/maxjuniorbr/segflow-crm/tree/main/.cursor/skills/auth-implementation-patterns
Command: npx skills add https://github.com/maxjuniorbr/segflow-crm --skill auth-implementation-patterns-maxjuniorbr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides structured, battle-tested authentication and authorization patterns (JWT, RBAC, sessions) to implement secure login, route protection, and access control in SegFlow CRM.

Core Features & Use Cases

  • JWT-based authentication with short-lived access tokens and rotating refresh tokens.
  • Role-Based Access Control (RBAC) and permission-based controls to grant least-privilege access.
  • Session-based approaches with secure cookies and CSRF protections, plus OAuth2/OpenID Connect patterns where applicable.
  • Guidance on secure token storage, error handling with AppError, and adherence to project's architecture (routes -> controllers -> useCases -> repositories -> entities).
  • Use cases include API protection, user management security, and secure migration of authentication flows.

Quick Start

Implement a JWT-based login flow with short-lived access tokens, rotate refresh tokens, and protect routes using RBAC and middleware.

Frequently Asked Questions about auth-implementation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication with refresh token rotation in a JavaScript backend?▼

JWT authentication with refresh token rotation is implemented using short-lived access tokens and hashed refresh tokens stored in a database. This pattern enforces secure session management via httpOnly cookies and standardized error handling.

What is the best way to set up RBAC and route protection in a scalable system?▼

Role-Based Access Control is set up by applying permission-based middleware to enforce least-privilege access. This protects API routes by verifying user roles before requests reach controllers and use cases.

How do I validate login data and handle authentication errors securely?▼

Login data is validated securely using Zod-based validation, while authentication errors are managed through standardized AppError handling. This ensures structured responses across login and token refresh flows.

Can I use OAuth2 and session-based cookies with my existing JavaScript architecture?▼

OAuth2 and OpenID Connect patterns can be applied alongside session-based secure cookies and CSRF protections. The implementation integrates into backend JavaScript architecture spanning routes, controllers, and repositories.

When should I use short-lived access tokens instead of long-lived sessions?▼

Short-lived access tokens are used for API protection to minimize exposure risk, while rotating refresh tokens maintain persistent sessions. This approach is ideal for scalable systems requiring strict access control.

Related Skills

Explore More Software Engineering Skills→
maxjuniorbrmaxjuniorbr
2

nodejs-backend-patterns

Enforce unified Node.js backend patterns across routes, controllers, and tests.

Community
Advanced
cosmixcosmix
53

auth

Implement authentication and authorization with OAuth2, JWT, and RBAC/ABAC.

Community
Advanced
AppleLampsAppleLamps
1

api-route-scaffold

Scaffolds Next.js API routes with OPTIONS/POST handlers, CORS, and error handling.

Community
Intermediate
markus41markus41
18

Keycloak FastAPI Integration

Integrate Keycloak into FastAPI with OpenID Connect and OAuth2 for JWT validation.

Community
Advanced