forge-auth

What problem does it solve?

This Skill prevents high-impact authentication mistakes by replacing fragile, ad-hoc patterns with well-understood, production-grade security primitives.

Core Features & Use Cases

• Hard rules for password hashing, sessions, JWT, OAuth, MFA, and resets: Argon2id/bcrypt, CSPRNG session IDs, secure cookies, RS256/EdDSA JWT verification, OAuth 2.1 with PKCE + state, MFA via TOTP/WebAuthn, and single-use hashed reset tokens.
• Anti-enumeration and timing discipline: Prevents user/account discovery and response-timing leaks on login and signup flows.
• Operational verification guidance: Includes an executable verifier that flags common weak patterns (e.g., Math.random for tokens, JWT decode without verify, localStorage token storage).

Quick Start

Use the forge-auth verifier to scan your authentication code at forge-auth/verify/check_auth.sh with a path to your auth implementation file.