auth

Secure sign-in flows require server-side validation, session management, and protection against common attacks like CSRF and injection. This skill provides sign-in templates for password-based, passwordless, and MFA options, with guidance on session lifecycle, token handling, and server-enforced authorization to protect user credentials and maintain secure state across requests.

SSO integration patterns delegate authentication to trusted providers like Google or GitHub, reducing credential management burden. This skill covers SSO setup with major identity providers, including session handling, token validation, and how to enforce authorization decisions server-side to ensure secure delegation without compromising your app's security posture.

Passwordless authentication—via passkeys, email links, or device verification—eliminates password-related vulnerabilities. This skill includes passwordless flow templates and best practices for implementing them securely, including recovery mechanisms and session management to maintain protection across web and mobile contexts.

Session management requires secure token generation, expiration policies, and server-side validation on every request. This skill covers session lifecycle best practices, including secure storage, refresh strategies, and how to enforce authorization decisions server-side to prevent token misuse and session hijacking.

Yes. This skill provides authentication patterns and session management guidance applicable across web and mobile contexts, covering platform-specific considerations like token storage, deep-linking, and cross-platform session consistency while maintaining server-side security enforcement.

Critical considerations include server-enforced authorization, secure recovery flows, protection against injection and CSRF attacks, and proper token handling. This skill emphasizes these security patterns throughout, helping you avoid common pitfalls and design authentication that scales without compromising user safety.