skills.rest
bbrowning
bbrowningCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

Reviewing Authentication and Authorization Security

Automate security reviews of JWT, OAuth 2.0/2.1, PKCE, and token exchange code.

2|1|Updated Oct 22, 2025
Search Tags:#authorization#authentication#oauth#jwt#security-review#PKCE
One-click install
npx skills add https://github.com/bbrowning/bbrowning-claude-marketplace --skill reviewing-authentication-and-authorization-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Reviewing Authentication and Authorization Security
Source: https://github.com/bbrowning/bbrowning-claude-marketplace/tree/main/bbrowning-claude/skills/auth-security
Command: npx skills add https://github.com/bbrowning/bbrowning-claude-marketplace --skill reviewing-authentication-and-authorization-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Provides security guidance for reviewing authentication and authorization code, focusing on JWT validation, token exchange, OAuth 2.1, PKCE, and MCP security; helps identify critical vulnerabilities and improper token handling.

Core Features & Use Cases

  • JWT best practices: Validate audience, issuer, signature, and alg.
  • Token exchange: Prefer token exchange over forwarding tokens for service-to-service calls.
  • MCP security: Enforce OAuth 2.1, PKCE, resource indicators, and no session-based auth.
  • Review scope: Check for token scope correctness and secure storage.

Quick Start

Use during reviews of authentication/authorization changes: verify token validation, PKCE usage, and token exchange, and ensure no token forwarding to downstream services.

Frequently Asked Questions about Reviewing Authentication and Authorization Security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review JWT validation in authentication code?▼

JWT validation requires checking audience, issuer, signature, and algorithm claims. This Skill automates identification of misconfigurations like missing audience validation, weak algorithms, or improper signature verification in JWT-based auth systems.

What security issues should I look for in OAuth 2.0 implementations?▼

OAuth 2.0 security reviews must verify PKCE usage, proper token exchange patterns, correct scope assignment, and secure token storage. This Skill identifies misconfigurations in OAuth 2.0 and 2.1 flows across user-facing and service-to-service pathways.

How should I handle token exchange between services instead of token forwarding?▼

Token exchange replaces direct token forwarding by securely exchanging tokens for service-to-service calls, reducing exposure if a token is compromised. This Skill enforces token exchange patterns and flags instances where tokens are improperly forwarded downstream.

What are the security requirements for MCP authorization?▼

MCP authorization requires OAuth 2.1, PKCE, resource indicators, and prohibits session-based authentication. This Skill verifies these controls are enforced and identifies violations in MCP security configurations.

Can this Skill review authentication code across different frameworks and platforms?▼

Yes. This Skill applies generically to JWT handling, OAuth flows, token exchange, and session management, covering service-to-service and user-facing authentication regardless of the underlying framework or platform.

What happens if authentication code doesn't validate token scope correctly?▼

Incorrect token scope validation allows tokens with insufficient permissions to access protected resources, creating authorization bypass vulnerabilities. This Skill detects scope mismatches and missing scope verification during code reviews.

Related Skills

Explore More Software Engineering Skills→
bilalmkbilalmk
1

configuring-better-auth

Configure OAuth 2.1 and OIDC authentication with Better Auth and MCP.

Community
Advanced
zangxin75zangxin75

security-reviewer

Conduct security audits and code vulnerability reviews with SAST scans.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-for-vulnerabilities

Scan codebases, dependencies, and configurations for security vulnerabilities and CVEs.

Community
Intermediate
FlorianBruniauxFlorianBruniaux
88

security-guardian

Audit application code for OWASP Top 10 vulnerabilities and security flaws.

Community
Advanced