authentication-flow

Implement Rails 8 authentication with signed HTTP-only session cookies.

1|Updated Jan 8, 2026
One-click install
npx skills add https://github.com/LaunchPadLab/ai-bank --skill authentication-flow-launchpadlab
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: authentication-flow
Source: https://github.com/LaunchPadLab/ai-bank/tree/main/claude/skills/authentication-flow
Command: npx skills add https://github.com/LaunchPadLab/ai-bank --skill authentication-flow-launchpadlab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill solves the problem of implementing secure, repeatable user authentication and session management in a Rails 8 app without relying on heavyweight authentication gems.

Core Features & Use Cases

  • Rails 8 Authentication Generator Workflow: Create a complete authentication flow (User, Session, Current, controller concerns, and basic views) using built-in Rails 8 tooling.
  • Session and Cookie Security: Establish signed, HTTP-only session token cookies and request-local user access via Current attributes.
  • Login/Logout and Password Reset Support: Provide controller patterns for login, logout, and password reset journeys.

Use cases include securing controllers by default, enabling public endpoints selectively, resuming sessions from signed cookies, and wiring authentication into request handling with Current.user for views and controller logic.

Quick Start

Ask the AI to implement Rails 8 authentication in your project by running the Rails generator, migrating the database, and wiring controllers to protect actions and manage the signed session token cookie.

Frequently Asked Questions about authentication-flow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up Rails 8 authentication without using third-party authentication gems?

Rails 8 authentication can be set up without third-party gems by generating a token-backed Session model, using an Authentication concern for require_authentication, and managing signed HTTP-only session cookies. This provides secure user login, logout, and password reset flows.

What is the best way to secure controllers by default and exempt public endpoints in Rails?

Securing controllers by default in Rails uses an Authentication concern with require_authentication behavior to protect actions. Public endpoints are enabled selectively by exempting specific unauthenticated routes within the controller logic.

How does session persistence work with signed cookies and Current attributes in Rails?

Session persistence in Rails uses signed, HTTP-only session token cookies for resumable authentication. Request-local user access is handled via Current attributes, exposing Current.user to views and controller logic during the authenticated request.

Does the Rails 8 authentication system support password reset journeys out of the box?

The Rails 8 authentication system supports password reset journeys by providing specific controller patterns. It integrates these patterns with the generated User, Session, and Current models to handle the complete password reset flow securely.

Can I use this authentication approach if my Rails app already has an existing User model?

You can use this authentication approach with an existing User model by adding the generator output structure, migrating the database for the token-backed Session model, and wiring the Authentication concern into your current request handling setup.