secure-auth

Implement session-based and token-based authentication patterns with Node.js.

359|61|Updated Dec 25, 2025

Search Tags:#security #authentication #OAuth #JWT #Express.js #MFA

Ready to run

npx skills add https://github.com/jamditis/claude-skills-journalism --skill secure-auth

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-auth
Source: https://github.com/jamditis/claude-skills-journalism/tree/main/secure-auth
Command: npx skills add https://github.com/jamditis/claude-skills-journalism --skill secure-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides production-ready patterns for implementing secure user authentication in web, mobile, and API services, reducing common pitfalls like insecure token storage and session fixation.

Core Features & Use Cases

Supports both session-based and token-based authentication architectures, with secure session handling and token rotation concepts.
Includes password hashing with strong cost factors (e.g., bcrypt), password reset flows, multi-factor authentication (MFA) via TOTP, and OAuth integration.
Use Case: Build a multi-service web application with a cohesive login flow, revocation, and secure cross-service auth.

Quick Start

Set up a secure login flow in Express using bcrypt for password hashing and Redis-backed sessions, with JWT refresh tokens and MFA as optional.

Frequently Asked Questions about secure-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement secure JWT authentication in Express.js?▼

Implement secure JWT authentication in Express.js by using bcrypt for password hashing, Redis-backed sessions, and JWT refresh tokens with rotation. This pattern provides secure cross-service auth with revocation controls and prevents session fixation.

What's the best way to add MFA to a Node.js web application?▼

Add MFA to a Node.js web application using TOTP integration alongside standard login flows. This approach delivers production-ready multi-factor authentication using standard npm packages without requiring external tooling.

How does session-based authentication compare to token-based authentication for web apps?▼

Session-based authentication uses server-side storage like Redis with CSRF protections, while token-based authentication uses JWTs with rotation and revocation. Both provide secure user authentication but differ in state management and cross-service scaling.

Can I set up OAuth integration and password reset flows without external tooling?▼

Set up OAuth integration and password reset flows using standard Node.js and npm packages with common databases. This configuration establishes secure defaults and rotation controls without requiring external tooling beyond standard npm packages.

Do I need Redis to handle secure session management and token rotation?▼

Redis is recommended for Redis-backed sessions but standard common databases also support secure session handling and token rotation. The implementation prescribes secure defaults and revocation controls across server and client boundaries regardless of storage backend.

When should I implement password hashing with bcrypt for authentication security?▼

Implement password hashing with bcrypt using strong cost factors when building login flows for web, mobile, or API services. This prevents common authentication pitfalls like insecure token storage and session fixation in production environments.