security

Name: security
Availability: InStock
Author: TimeKast

Enforce NextAuth.js v5 split-config, RBAC route guarding, and server-side session verification.

Updated May 19, 2026

Search Tags:#input validation #rate limiting #middleware #rbac #zod #security hardening #nextauth

Ready to run

npx skills add https://github.com/TimeKast/AgendaInteligente --skill security-timekast

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/TimeKast/AgendaInteligente/tree/main/.agent/skills/domains/security
Command: npx skills add https://github.com/TimeKast/AgendaInteligente --skill security-timekast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you prevent common security failures in modern web apps by standardizing authentication, authorization, input validation, and attack mitigation patterns.

Core Features & Use Cases

NextAuth.js v5 split-config security architecture: Implements the required Edge-safe auth.config.ts and Node runtime auth.ts setup to ensure middleware authorization has the data it needs.
RBAC done in the right place (Route ACL vs Resource Permission): Enforces route-level access via authorized() and action-level access via server actions/API logic.
Input validation and attack prevention playbook: Uses Zod validation, safe query building, XSS handling guidance, CSRF checks for API routes, and rate limiting patterns.

Quick Start

Configure your NextAuth v5 auth split-config, implement RBAC in the authorized() callback, and add Zod validation to every entry point to secure authentication and permissions before deploying.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure NextAuth.js v5 split-config for edge middleware?▼

NextAuth.js v5 split-config separates Edge-safe logic in auth.config.ts from Node runtime logic in auth.ts, enabling middleware authorization to access required session data. This architecture supports secure RBAC route guarding and server-side session verification.

What's the best way to implement RBAC route guarding in Next.js?▼

Implement RBAC route guarding by enforcing route-level access via the authorized() callback in middleware, and action-level access via server actions or API logic. This enforces least-privilege checks and ensures server-side session verification across your Next.js application.

How do I validate input and prevent web attacks in server actions?▼

Validate input in server actions by applying Zod parsing at every entry point to strictly validate data boundaries. Prevent common web attacks by using safe query building without SQL interpolation, handling XSS, and enforcing CSRF checks for API routes.

Does this security hardening approach work with middleware and API routes?▼

Yes, this security hardening applies to apps using middleware, server actions, and API routes. It enforces Edge-safe callbacks, role-based access control, input validation, rate limiting, and safe logging across these boundaries to prevent unauthorized access and common attacks.

Why do I need Zod validation at API boundaries?▼

You need Zod validation at API boundaries to parse and sanitize incoming data before it reaches your application logic. Parsing at boundaries prevents malformed input from causing SQL interpolation vulnerabilities, XSS, and other common web attacks.