moai-security-auth

MFA and WebAuthn add passwordless, phishing-resistant authentication layers. This Skill implements FIDO2/WebAuthn registration and authentication flows, MFA enrollment workflows, and secure session management across distributed applications using modern patterns like NextAuth.js 5.x and Passport.js compatibility.

OAuth 2.1 delegates authentication to trusted providers; JWT-based sessions are stateless tokens verified by your server; passwords require secure storage. This Skill integrates OAuth 2.1/OpenID Connect providers, implements JWT token refresh mechanisms, and manages secure session handling for each approach.

Passwordless migrations require phased rollouts with fallback support. This Skill covers passwordless migration strategies, passkey enrollment and authentication flows, and SSO setup to transition users from traditional passwords to WebAuthn and FIDO2 hardware keys.

Yes. JWT-based stateless sessions and OAuth 2.1 integration enable SSO across distributed applications. This Skill includes distributed session management, JWT validation patterns, and OAuth provider setup for cross-service authentication without centralized session storage.

JWT tokens require secure storage, rotation, and validation; sessions need refresh mechanisms and expiration policies. This Skill addresses secure token generation, refresh token flows, session timeout handling, and FIDO2 hardware key support to prevent common authentication vulnerabilities.

Yes. WebAuthn (FIDO2) is a standard for hardware security keys. This Skill implements FIDO2 hardware key support, WebAuthn registration and authentication flows, and passkey management compatible with industry-standard authenticators like YubiKeys.