skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

auth-tls-patterns

Implement localhost auth bypass and TLS fallback for FastAPI services.

10|11|Updated Feb 22, 2026
Search Tags:#security#authentication#fastapi#tls#localhost#certificates#bearer token
One-click install
npx skills add https://github.com/microsoft/amplifier-bundle-skills --skill auth-tls-patterns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-tls-patterns
Source: https://github.com/microsoft/amplifier-bundle-skills/tree/main/skills/auth-tls-patterns
Command: npx skills add https://github.com/microsoft/amplifier-bundle-skills --skill auth-tls-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you design services that stay frictionless on localhost while still enforcing real authentication and HTTPS for remote access. It removes the need to manually configure passwords, tokens, or certificates for every environment.

Core Features & Use Cases

  • Localhost bypass: Uses socket-level client IP checks so loopback access can skip auth safely.
  • Automatic auth setup: Supports cascading authentication strategies such as PAM, password files, and auto-generated bearer tokens.
  • Automatic TLS setup: Selects the best certificate path available, from Tailscale-backed certs to mkcert or self-signed certificates.
  • Security hardening: Includes constant-time secret comparison, restrictive file permissions, and SAN-aware certificate generation.
  • Use case: Ideal for a local web UI or developer tool that should work instantly on your machine but require secure credentials when exposed remotely.

Quick Start

Ask the AI to adapt your service with localhost bypass, auto-generated authentication, and a TLS fallback chain that works for both local development and remote deployment.

Frequently Asked Questions about auth-tls-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure FastAPI to skip authentication on localhost but require it for remote access?▼

Localhost bypass uses socket-level client IP checks to verify loopback access, allowing local requests to skip authentication safely while enforcing credentials for remote connections.

What is the best way to automatically generate bearer tokens for a local developer tool?▼

Automatic bearer token generation uses cascading authentication strategies to provision credentials, supporting PAM, password files, and auto-generated tokens to secure remote access without manual setup.

How does TLS fallback work with Tailscale or mkcert for local web UIs?▼

TLS fallback selects the best available certificate path by checking Tailscale-backed certificates, mkcert configurations, or self-signed certificates to provide HTTPS automatically for local and remote services.

Does constant-time secret comparison prevent timing attacks on bearer token authentication?▼

Constant-time secret comparison prevents timing attacks by ensuring the authentication process takes the same time regardless of whether the bearer token matches, combined with restrictive file permissions.

Can I use self-signed certificates with FastAPI without manual configuration?▼

Self-signed certificates are automatically provisioned through TLS fallback support, allowing FastAPI apps to enable HTTPS without manual configuration when Tailscale or mkcert certificates are unavailable.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
34

DDoS Attack Testing

Simulate DDoS attacks and configure Snort IDS rules.

Community
Advanced
JhabbigJhabbig

mtls-configuration

Configure mutual TLS policies for Kubernetes and service mesh environments.

Community
Advanced
kagentikagenti
292

openshift:trusted-ca-bundle

Mount the OpenShift trusted CA bundle into pods for TLS verification.

Official
Basic
L3DigitalNetL3DigitalNet
6

openssl-cli

Manage SSL/TLS certificates, private keys, and CSRs with OpenSSL.

Official
Intermediate