auth-skill

Secure JWT authentication requires hashing passwords with salt before storage and issuing signed tokens upon login. This approach validates users, manages token expiration, and enforces access control on protected REST or GraphQL routes.

OAuth social login integrates external providers like Google or GitHub to authenticate users without handling their passwords directly. This method manages provider tokens, establishes secure sessions, and maps external identities to your application's user records.

Multi-factor authentication requires users to provide additional verification alongside passwords before JWTs are issued. Token refresh flows then securely issue new access tokens using secure cookies, maintaining authenticated sessions without repeated MFA prompts.

Yes, this authentication approach applies to both REST and GraphQL APIs. It validates users, issues JWTs, and enforces role-based access control across either protocol, ensuring consistent signup, signin, and session management security.

Yes, rate limiting and input validation are critical for secure user signup flows. Rate limiting prevents brute-force attacks on signin endpoints, while input validation sanitizes incoming data to protect against injection vulnerabilities during password hashing and user creation.

Using salt when hashing passwords ensures that identical passwords produce different hash values, preventing rainbow table attacks. Secure authentication flows generate unique salts per user before hashing, safeguarding stored credentials even if the database is compromised.