skills.rest
NalinDalal
NalinDalalCOMMUNITY
Explore all skills by this author →
Website𝕏@nalin82929GitHub

auth

Implements session-based, JWT, OAuth2, magic link, and MFA authentication patterns in TypeScript.

1|Updated Aug 17, 2026
Search Tags:#typescript#authentication#jwt#RBAC#session#OAuth2#mfa
One-click install
npx skills add https://github.com/NalinDalal/skillset --skill auth-nalindalal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth
Source: https://github.com/NalinDalal/skillset/tree/main/skills/backend/auth
Command: npx skills add https://github.com/NalinDalal/skillset --skill auth-nalindalal

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building secure authentication from scratch is error-prone, and mistakes in session handling, token rotation, or OAuth flows create serious vulnerabilities. This Skill provides production-oriented TypeScript patterns for every common auth mechanism so you implement them correctly the first time. ## Core Features & Use Cases - Session & JWT Auth: Redis-backed session storage with httpOnly cookies, plus short-lived access tokens with refresh token rotation for mobile and API clients. - OAuth2/OIDC & Passwordless: Google OAuth flow with state validation, magic link sign-in, email verification, and password reset with session revocation. - MFA & RBAC: TOTP-based multi-factor enrollment and a permission matrix for role-based access control middleware. - Use Case: You need to add Google sign-in plus MFA to an existing app. Load this Skill to get the OAuth callback handler, session creation, and TOTP verification code wired together with a security checklist. ## Quick Start Ask the agent to implement session-based authentication with JWT refresh tokens and Google OAuth for your API.

Frequently Asked Questions about auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT refresh token rotation in TypeScript?▼

Issue a 15-minute access token and a 30-day refresh token signed with separate secrets using jose. On refresh, verify the token, confirm the session still exists in Redis, then issue a new token pair and store the new refresh token to invalidate the old one.

Should I use sessions or JWT for web app authentication?▼

Session-based auth with httpOnly, secure, sameSite=lax cookies is recommended for web apps because tokens stay server-side in Redis and can be revoked instantly. JWTs suit mobile clients, APIs, and WebSocket connections where cookie handling is impractical.

How do I add Google OAuth2 login to my app?▼

Redirect users to Google's authorization URL with a state parameter stored in a cookie, then exchange the returned code for tokens and fetch the user profile. Verify the state matches before creating or looking up the user and starting a session.

How does TOTP MFA verification work?▼

Generate a TOTP secret, store it on the user record, and show the otpauth URI as a QR code. Verify submitted codes against the secret with a one-step window, and only mark MFA enabled after the first successful verification.

Why should password reset revoke all user sessions?▼

Revoking sessions on password reset prevents an attacker who compromised the account from retaining access after the legitimate user recovers it. The pattern deletes all Redis session keys for the user after updating the password hash.

What are the limitations of Redis session storage?▼

Redis sessions require a running Redis instance and add latency to every authenticated request for the lookup. Deleting all sessions for a user requires scanning keys, which becomes expensive at scale without a per-user session index.

Related Skills

Explore More Software Engineering Skills→
bjornslibbjornslib

database

Provision Railway databases and wire connection strings into services.

Community
Intermediate
vishalsachdevvishalsachdev
2

secure-nextjs-api-routes

Secure Next.js 13+ App Router API routes with composable middleware.

Community
Advanced
Jicate-SolutionsJicate-Solutions

supabase-email-auth

Implement Supabase email authentication in Next.js with PKCE flow.

Official
Advanced
Probably-GroupProbably-Group
3

kanidm-expert

Design secure Kanidm deployments for OAuth2/OIDC, LDAP, and WebAuthn.

Official
Advanced