security-auth

Configure NextAuth authentication with JWT sessions, bcrypt hashing, and OWASP-aligned security controls.

Updated Aug 23, 2026

Search Tags:#security #jwt #session #rate-limiting #auth #csrf #NextAuth

Ready to run

npx skills add https://github.com/andrew-tucker-razorvision/EFT-Tracker --skill security-auth-andrew-tucker-razorvision

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auth
Source: https://github.com/andrew-tucker-razorvision/EFT-Tracker/tree/main/.claude/skills/security-auth
Command: npx skills add https://github.com/andrew-tucker-razorvision/EFT-Tracker --skill security-auth-andrew-tucker-razorvision

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Authentication and security patterns are critical for protecting user data in EFT-Tracker. This Skill covers NextAuth configuration, password security, rate limiting, and a secure security checklist to reduce risk.

Core Features & Use Cases

NextAuth configuration: session strategy, secure cookies
Password hashing & reset: bcrypt usage, reset flow
Threat coverage: OWASP top 10 items, rate limiting, security headers

Quick Start

Configure NextAuth with secure cookies and implement a password reset flow following the guide above.

Frequently Asked Questions about security-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement secure authentication with NextAuth in a Node.js application?▼

NextAuth provides session management and JWT-based authentication out of the box. Configure it with secure cookie settings, set up providers (credentials, OAuth), and define your session strategy in your API route. This handles login, logout, and session validation across your app.

What's the best way to hash and reset user passwords securely?▼

Use bcrypt with at least 12 rounds to hash passwords before storage. For password reset, generate a token with an expiration timestamp, store it hashed in your database, and send a reset link via email. Verify the token and expiration before allowing a new password.

How do I protect my API endpoints from CSRF attacks and rate limiting?▼

CSRF protection requires verifying origin headers and using anti-CSRF tokens in forms. Implement rate limiting on sensitive endpoints—track requests per IP or user ID and reject requests exceeding your threshold. Both are essential for OWASP-aligned security.

Can I use JWT tokens with secure cookies for session management?▼

Yes. Store JWT tokens in HTTP-only, secure cookies so they're automatically sent with requests but inaccessible to JavaScript. This combines JWT flexibility with cookie security, protecting against XSS attacks while maintaining stateless session validation.

What security headers and input validation should I add to my authentication routes?▼

Add headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security to prevent injection and clickjacking. Validate all user inputs (email format, password length, token format) before processing to block malformed or malicious requests.