skills.rest
medispis
medispisCOMMUNITY
Explore all skills by this author →
GitHub

auth

Designs and implements authentication and authorization systems using JWT, OAuth, sessions, and RBAC.

Updated Jun 2, 2026
Search Tags:#authorization#security#authentication#oauth#jwt#middleware#rbac
One-click install
npx skills add https://github.com/medispis/opencode-config --skill auth-medispis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth
Source: https://github.com/medispis/opencode-config/tree/main/skills/auth
Command: npx skills add https://github.com/medispis/opencode-config --skill auth-medispis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building secure login, token management, and permission systems from scratch is error-prone, and mistakes in auth logic lead to serious vulnerabilities like weak password hashing, insecure token storage, or missing access controls. ## Core Features & Use Cases - Multiple Auth Types: Implements JWT with refresh tokens, server-side sessions, OAuth/OIDC with PKCE, and hashed API keys. - Authorization Patterns: Designs RBAC role-permission mappings and ABAC attribute-based policies enforced at the route level. - Security Checklist: Enforces bcrypt/argon2 hashing, rate limiting, account lockout, token rotation, CSRF protection, and HTTPS. - Use Case: When adding login to a web app, use this Skill to generate auth middleware, register/login/refresh/logout endpoints, and role-based guards following security best practices. ## Quick Start Ask the agent to design and implement a JWT-based authentication system with refresh tokens and role-based access control for your API.

Frequently Asked Questions about auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication with refresh tokens?▼

Issue short-lived access tokens paired with long-lived refresh tokens stored in httpOnly cookies or a database. Include minimal claims like sub, role, and exp, and implement refresh token rotation to invalidate old tokens on each use.

Should I use JWT or session-based authentication for my web app?▼

Session-based auth uses a server-side store like Redis with httpOnly, secure, sameSite cookies and suits traditional web apps. JWT suits stateless APIs and distributed services, but never store JWTs in localStorage for web applications.

What is the difference between RBAC and ABAC authorization?▼

RBAC maps permissions to roles like admin or moderator and checks them at the route level. ABAC evaluates policies based on user attributes, resource attributes, and context, offering more flexibility for complex permission systems.

How should API keys be stored securely?▼

Generate API keys with a cryptographically secure random generator and hash them before storage, just like passwords. Support key rotation and revocation, and apply per-key rate limiting to limit abuse.

Why is storing JWTs in localStorage considered insecure?▼

localStorage is accessible to any JavaScript running on the page, so an XSS vulnerability can steal the token. Use httpOnly cookies for web apps instead, which JavaScript cannot read, combined with CSRF protection.

Related Skills

Explore More Software Engineering Skills→
mateo-khalilmateo-khalil
1

nodejs-express-server

Create Express.js servers with routing, middleware, authentication, and Sequelize database integration.

Community
Advanced
williamzujkowskiwilliamzujkowski
17

nist

Map systems to NIST controls and generate implementation plans.

Community
Advanced
SeanChenRSeanChenR

better-auth-security-best-practices

Configure rate limiting, CSRF protection, and audit logging for Better Auth.

Community
Advanced
orangehrmorangehrm
1.1k

auth-providers

Diagnose and configure OrangeHRM authentication, including LDAP, OAuth2, and OpenID Connect.

Official
Advanced