auth-implementation-patterns

Implement JWT, OAuth2, session, and RBAC authentication patterns.

Updated Jan 13, 2026

Search Tags:#authorization #security #authentication #api #jwt #rbac #oauth2

Ready to run

npx skills add https://github.com/shinnytech/caiwenqiang-member-rank --skill auth-implementation-patterns-shinnytech

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-implementation-patterns
Source: https://github.com/shinnytech/caiwenqiang-member-rank/tree/main/.cursor/skills/auth-implementation-patterns
Command: npx skills add https://github.com/shinnytech/caiwenqiang-member-rank --skill auth-implementation-patterns-shinnytech

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, express-session, passport, passport-google-oauth20, bcrypt, zod, express-rate-limit, rate-limit-redis, connect-redis, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides comprehensive guidance and code examples for implementing robust authentication and authorization mechanisms, ensuring secure and scalable access control for applications.

Core Features & Use Cases

Authentication Strategies: Covers session-based, JWT-based, and OAuth2/OpenID Connect flows.
Authorization Patterns: Implements Role-Based Access Control (RBAC), permission-based checks, and resource ownership verification.
Security Best Practices: Includes password hashing, rate limiting, and secure cookie configurations.
Use Case: Secure a new web application by implementing JWT-based authentication with refresh tokens and role-based access control for different user tiers.

Quick Start

Implement JWT authentication by using the provided TypeScript code snippets for token generation and verification.

Frequently Asked Questions about auth-implementation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication with refresh tokens in Express?▼

Role-Based Access Control (RBAC) restricts API endpoints by assigning permissions to user roles. This Skill implements RBAC alongside permission-based checks and resource ownership verification to secure APIs against unauthorized access.

What is the best way to set up OAuth2 authentication using Passport?▼

Password hashing with bcrypt secures user credentials by salting and encrypting passwords before database storage. This Skill includes security best practices like bcrypt hashing, rate limiting via express-rate-limit, and secure cookie configurations.

How does rate limiting work with Redis for API security?▼

Rate limiting with Redis uses rate-limit-redis and connect-redis to store request counters externally, preventing brute-force attacks. This Skill configures express-rate-limit with Redis stores to throttle API requests and secure authentication endpoints.

When should I use session-based authentication instead of JWT?▼

Session-based authentication suits server-rendered apps needing immediate revocation, while JWT fits stateless APIs. This Skill compares session-based, token-based, and OAuth2 strategies to help choose the right pattern for your application context.