skills.rest
peterbamuhigire
peterbamuhigireCOMMUNITY
Explore all skills by this author →
Website𝕏@peterbamuGitHub

dual-auth-rbac

Implement dual session and JWT authentication with RBAC for multi-tenant applications.

23|7|Updated Jan 23, 2026
Search Tags:#authorization#security#jwt#rbac#session#multitenancy#dual-auth
One-click install
npx skills add https://github.com/peterbamuhigire/skills-web-dev --skill dual-auth-rbac
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dual-auth-rbac
Source: https://github.com/peterbamuhigire/skills-web-dev/tree/main/dual-auth-rbac
Command: npx skills add https://github.com/peterbamuhigire/skills-web-dev --skill dual-auth-rbac

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Centralizes and secures authentication for multi-tenant apps by combining stateful web sessions with stateless JWTs and robust RBAC, preventing cross-tenant data leakage.

Core Features & Use Cases

  • Dual authentication architecture: session-based web access for browsers and JWT-based access for APIs/mobile clients, with consistent RBAC across both.
  • Tenant-aware RBAC: supports franchise-level isolation, per-tenant overrides, and device-bound tokens.
  • Strong security foundations: Argon2ID password hashing, per-tenant tokens with revocation, multi-layer middleware, and environment-driven hardening.
  • Reference schema and utilities: provides a comprehensive MySQL-based schema (schema.sql) and guidance for implementing permission resolution and MFA workflows.

Quick Start

Configure and deploy a production-grade dual-auth RBAC system for a multi-tenant application using session-based authentication for web UI and JWT for APIs.

Frequently Asked Questions about dual-auth-rbac

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement dual authentication with both session-based web access and JWT for APIs?▼

Dual authentication combines stateful session-based authentication for browser web UIs with stateless JWT-based access for API and mobile clients, applying consistent RBAC permission resolution across both access layers to secure multi-tenant applications.

How does RBAC work in a multi-tenant application to prevent cross-tenant data leakage?▼

Multi-tenant RBAC enforces franchise-level isolation by applying tenant-scoped permissions and cross-tenant data isolation rules during permission resolution, ensuring users only access data within their assigned tenant boundaries.

What is the best way to handle JWT token revocation for stateless API authentication?▼

JWT token revocation is handled through access and refresh token flows that support per-tenant revocation, allowing active tokens to be invalidated when needed while maintaining the stateless nature of API authentication.

Does this multi-tenant authentication approach support per-tenant overrides and environment-driven configuration?▼

Yes, the multi-tenant authentication architecture supports optional franchise-level overrides and environment-driven configuration hardening, allowing customization of security settings per tenant while maintaining centralized authentication standards.

How do I set up password hashing with Argon2ID for a multi-tenant auth system?▼

Argon2ID password hashing is implemented as part of the strong security foundations, providing robust credential storage alongside a provided MySQL-based reference schema and guidance for MFA workflows and permission resolution.

Can I use session-based authentication and JWT simultaneously across web and mobile clients?▼

Yes, the dual-auth architecture specifically supports using session-based authentication for web UIs requiring stateful browser sessions and JWT-based authentication for API and mobile clients requiring stateless token access with device-bound token support.

Related Skills

Explore More Software Engineering Skills→
lDuanglDuang

organization-best-practices

Configure multi-tenant organizations and RBAC with the Better Auth organization plugin.

Community
Advanced
ThethetraderThethetrader

auth-implementation

Implement OAuth 2.0, JWT, and session-based authentication with RBAC/ABAC.

Community
Advanced
mahg-esmahg-es
3

api-gateway

Design and configure API gateways for routing, authentication, and traffic management.

Official
Advanced
giuseppe-trisciuogliogiuseppe-trisciuoglio
322

spring-boot-security-jwt

Configure JWT authentication and authorization for Spring Boot applications.

Community
Advanced