skills.rest
The13thNode
The13thNodeCOMMUNITY
Explore all skills by this author →
GitHub

authentication-skill

Implement JWT, OAuth2, RBAC, and TOTP authentication for web and API applications.

3|Updated Mar 26, 2026
Search Tags:#authentication#jwt#rbac#session-management#mfa#oauth2#refresh-tokens
One-click install
npx skills add https://github.com/The13thNode/VibeCorp_PromptCEO --skill authentication-skill-the13thnode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authentication-skill
Source: https://github.com/The13thNode/VibeCorp_PromptCEO/tree/main/skills/public/authentication-skill
Command: npx skills add https://github.com/The13thNode/VibeCorp_PromptCEO --skill authentication-skill-the13thnode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a clear, production-minded approach to implementing authentication and authorization so teams can safely handle user login, session management, social sign-in, and permission enforcement without common security pitfalls.

Core Features & Use Cases

  • JWT and Token Rotation: Patterns for short-lived access tokens and rotating refresh tokens stored in secure httpOnly cookies to mitigate token theft.
  • Session Management & Middleware: Server-side session advice and auth middleware for protecting routes and extracting user context.
  • OAuth2 / Social Login: Authorization code flow, state parameter handling for CSRF protection, and guidance for linking external identities to local users.
  • RBAC & Permissions: Role and permission design patterns with middleware to enforce fine-grained access control.
  • MFA Options: TOTP (authenticator apps) and guidance for SMS-based verification with provider recommendations.
  • Managed Provider Guidance: When to use Clerk, Auth0, Supabase, NextAuth, or build a custom solution for compliance needs.
  • Use Case: Build a SaaS product sign-up and login system that supports Google sign-in, role-based admin features, and secure token refresh for single-page apps.

Quick Start

Implement JWT access tokens with refresh token rotation using secure httpOnly cookies, add OAuth2 Google login with state verification, and enforce RBAC middleware on protected endpoints.

Frequently Asked Questions about authentication-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT access and refresh token rotation for a single-page application?▼

JWT access token rotation involves issuing short-lived access tokens and securely rotating refresh tokens stored in httpOnly cookies to mitigate token theft. This approach protects SPA backends by invalidating stolen refresh tokens after a single use.

What is the best way to add OAuth2 social login with CSRF protection?▼

OAuth2 social login uses the authorization code flow with a state parameter to provide CSRF protection. This mechanism validates the state value upon return to safely link external identities like Google sign-in to local users.

How does RBAC middleware enforce role-based access control on protected API routes?▼

RBAC middleware enforces role-based access control by intercepting protected API routes, checking user permissions extracted from the request context, and denying access when the authenticated user lacks required role privileges.

Can I set up TOTP-based MFA using authenticator apps for my web application?▼

Yes, you can set up TOTP-based MFA for web applications using authenticator apps. This process integrates TOTP generation and verification alongside alternative SMS-based verification guidance to secure user login flows.

When should I use managed authentication providers versus building a custom auth solution?▼

Use managed authentication providers like Clerk, Auth0, Supabase, or NextAuth for rapid development, and build custom auth solutions when specific compliance needs require full control over session management and token handling infrastructure.

Why does secure cookie handling matter for session management in web apps?▼

Secure cookie handling matters for session management because it prevents client-side scripts from accessing sensitive tokens. Storing refresh tokens in secure httpOnly cookies protects web app sessions from cross-site scripting theft.

Related Skills

Explore More Software Engineering Skills→
mcclowesmcclowes

nextjs-client-cookie-pattern

Set cookies from Next.js client components via server actions.

Community
Intermediate
shuremali02shuremali02

jwt-auth-guard

Verify Better Auth JWT tokens in FastAPI requests and inject authenticated users into route handlers.

Community
Intermediate
SkobynSkobyn

hunt-brute-force

Detect login brute force, OTP/2FA brute force, and credential stuffing vulnerabilities.

Community
Advanced
Carts1024Carts1024
1

convex-setup-auth

Set up Convex authentication with multiple auth providers and identity mapping.

Community
Intermediate