forge-auth

Secure JWT verification requires strict algorithm enforcement using RS256 or EdDSA, explicitly rejecting unsigned tokens. This Skill hardens JWT implementations by preventing decode-without-verify vulnerabilities and eliminating weak token storage patterns like localStorage.

The best way to implement OAuth PKCE involves requiring mandatory state parameters alongside code challenges. This Skill enforces OAuth 2.1 standards by mandating PKCE and state validation, replacing ad-hoc authorization flows with production-grade security primitives.

Preventing user enumeration requires anti-enumeration controls and strict response timing discipline on login and signup flows. This Skill secures authentication endpoints by implementing enumeration-safe responses and preventing account discovery through timing leaks.

Password reset flows require hashed single-use reset tokens to prevent replay attacks and token interception. This Skill hardens account recovery endpoints by enforcing hashed reset tokens with enumeration-safe responses, replacing fragile reset patterns.

Configuring secure session cookies requires setting HttpOnly, Secure, and SameSite attributes alongside CSPRNG-generated session identifiers. This Skill enforces secure cookie configurations and cryptographically secure session IDs to resist session fixation breaches.

Argon2id is recommended for password hashing when resisting GPU-based attacks is critical, while bcrypt remains a viable fallback. This Skill enforces argon2id and bcrypt hashing rules, replacing weak password storage patterns with production-grade primitives.