Implement OAuth 2.0 and OpenID Connect authorization code flows with PKCE.
npx skills add https://github.com/jpoutrin/product-forge --skill oauth
Please help me install this Agent Skill. Skill: oauth Source: https://github.com/jpoutrin/product-forge/tree/main/plugins/security-compliance/skills/oauth Command: npx skills add https://github.com/jpoutrin/product-forge --skill oauth
Implementing secure OAuth 2.0 and OpenID Connect authentication and authorization flows can be complex and error-prone. This Skill provides clear patterns and best practices to simplify integration with identity providers like Google or GitHub, ensuring robust security.
Use the oauth skill to generate a Python code snippet for implementing the Authorization Code Flow with PKCE for a new web application.
High-intent search queries and answers about installing and using this skill.
OAuth 2.0 authorization code flow is the recommended pattern for web apps to authenticate users with providers like Google or GitHub. It involves redirecting users to the provider's login page, receiving an authorization code, exchanging it for tokens server-side, and securely storing tokens for API access. This Skill provides step-by-step guidance and code patterns for each stage.
PKCE (Proof Key for Code Exchange) is a security extension to OAuth 2.0 required for public clients like SPAs and mobile apps that cannot securely store secrets. It prevents authorization code interception attacks by generating a code verifier and challenge on the client, validating them during token exchange. This Skill covers PKCE implementation patterns for these platforms.
Secure token handling involves storing access tokens in memory, refresh tokens in httpOnly cookies, validating token expiry, and implementing refresh strategies to obtain new access tokens without re-authentication. This Skill provides patterns for token lifecycle management, rotation, and secure storage across web, mobile, and backend services.
OAuth 2.0 is an authorization protocol for delegated access to APIs; OpenID Connect extends it to include user identity claims via ID tokens. OpenID Connect adds an identity layer, user info endpoints, and standardized claims. This Skill explains both protocols and shows how to integrate them for authentication and authorization.
Yes, HTTPS is mandatory for OAuth 2.0 deployments to protect tokens and authorization codes in transit. This Skill emphasizes HTTPS enforcement and strict redirect_uri validation as core security requirements to prevent token interception and phishing attacks.
ID token validation requires verifying the token signature using the provider's public keys, checking expiry, validating audience (aud) and issuer (iss) claims, and confirming the nonce matches your request. This Skill provides verification patterns and best practices for integrating custom and standard identity providers.
ColdBoxConfigure SAML2, OAuth2, or OIDC Single Sign-On for ColdBox and BoxLang applications.
chavangorakh1999Implement JWT authentication with httpOnly cookies and token rotation for MERN applications.
majiayu000Authenticate and authorize API requests with JWTs, API keys, and RBAC.
utsavthakurAnalyze authentication and authorization workflows for OAuth, JWT, SAML, CORS, CSRF, and SSO weaknesses.
