skills.rest
Ascenseurs-Menetrey-SA
Ascenseurs-Menetrey-SAOFFICIAL
Explore all skills by this author →
GitHub

setup-auth

Implement JWT authentication with refresh rotation for FastAPI and React.

Updated Aug 23, 2026
Search Tags:#authentication#react#fastapi#jwt#security hardening#httpOnly cookies#totp 2fa
One-click install
npx skills add https://github.com/Ascenseurs-Menetrey-SA/amsa-claude-skills --skill setup-auth-ascenseurs-menetrey-sa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: setup-auth
Source: https://github.com/Ascenseurs-Menetrey-SA/amsa-claude-skills/tree/main/setup-auth
Command: npx skills add https://github.com/Ascenseurs-Menetrey-SA/amsa-claude-skills --skill setup-auth-ascenseurs-menetrey-sa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents fragile or insecure authentication setups by providing a production-grade JWT auth checklist for FastAPI (backend) and React (frontend), including refresh rotation, cookies, CORS, rate limiting, and 2FA wiring.

Core Features & Use Cases

  • JWT + HttpOnly cookie security: Access/refresh/TOTP-pending tokens with strict cookie attributes, scoped paths, and payload type validation.
  • Complete auth endpoint suite (FastAPI): Login, refresh, logout, current user/admin/client retrieval, and full TOTP enable/disable flow.
  • Production hardening: slowapi rate limiting, mass-assignment protections, explicit CORS allowlists, DOMPurify for XSS mitigation, secure password hashing (Argon2id), and recommended security headers.
  • Frontend auth reliability (React): credentials include, transparent refresh retry with deduplication, logout cache clearing, route guarding, and safety checks for download URLs.

Quick Start

Use the setup-auth skill with your project context so it generates an implementation plan with team-mode orchestration and then applies the security checklist to your FastAPI + React codebase.

Frequently Asked Questions about setup-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure JWT authentication in a FastAPI and React application?▼

Secure JWT authentication for FastAPI and React involves using HttpOnly scoped cookies, strict token type validation, refresh token rotation, and Argon2id password hashing to protect production web apps.

What is the best way to handle JWT refresh token rotation with React and FastAPI?▼

JWT refresh token rotation requires transparent frontend refresh retry logic with deduplication, credentials inclusion, and strict cookie attributes to securely manage access and refresh tokens across React and FastAPI.

How does TOTP 2FA integration work with JWT cookies in a React frontend?▼

TOTP 2FA integration uses a pending token state within the JWT cookie flow, requiring a full enable and disable endpoint suite on the FastAPI backend alongside standard login and refresh routes.

Can I use slowapi rate limiting and explicit CORS allowlists to secure FastAPI auth endpoints?▼

Slowapi rate limiting and explicit CORS allowlists secure FastAPI auth endpoints by preventing brute force attacks and restricting cross-origin resource sharing alongside mass-assignment protections.

Why do I need HttpOnly scoped cookies for JWT tokens instead of local storage?▼

HttpOnly scoped cookies prevent XSS mitigation vulnerabilities by restricting JavaScript access, ensuring payload type validation and scoped paths protect access, refresh, and TOTP-pending tokens.

What security headers and XSS mitigation does a production FastAPI React auth system need?▼

Production FastAPI React auth systems need recommended security headers, DOMPurify for XSS mitigation, and logout cache clearing to ensure complete route guarding and download URL safety checks.

Related Skills

Explore More Software Engineering Skills→
vellum-aivellum-ai
1.0k

deploy-fullstack-vercel

Deploy a React frontend and FastAPI backend to Vercel as a serverless demo.

Official
Advanced
AsmayaseenAsmayaseen
2

docker-fastapi

Containerize Python/FastAPI applications with multi-stage Docker builds and non-root users.

Community
Advanced
CleanExpoCleanExpo
1

RBAC Patterns

Codify role-based access control patterns for NodeJS applications.

Community
Advanced
markus41markus41
1

authentication

Implement JWT, OAuth2, sessions, and RBAC for authentication and authorization.

Community
Intermediate