skills.rest
e-xode
e-xodeOFFICIAL
Explore all skills by this author →
WebsiteGitHub

vue-ssr-auth

Implement email security-code authentication with SHA-256 hashing and bcrypt password storage for Vue SSR apps using express-session, rate limiting, IP blocking, and optional reCAPTCHA v3 validation.

3|Updated Jan 14, 2023
Search Tags:#authentication#rate limiting#vue#session management#ssr#security code#recaptcha v3
One-click install
npx skills add https://github.com/e-xode/vue-ssr --skill vue-ssr-auth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vue-ssr-auth
Source: https://github.com/e-xode/vue-ssr/tree/main/.claude/skills/vue-ssr-auth
Command: npx skills add https://github.com/e-xode/vue-ssr --skill vue-ssr-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents insecure or fragile authentication implementations by providing a complete, security-focused auth and session management flow for a Vue SSR starter kit.

Core Features & Use Cases

  • Email security-code authentication: Implements signup/signin using a 6-digit code generated via crypto.randomInt, delivered by email, and verified before granting access to the dashboard.
  • Cryptographic verification & hardened sessions: Hashes security codes with SHA-256, verifies user input using timingSafeEqual, stores passwords with bcryptjs, and manages sessions with express-session using a file-based store.
  • Abuse resistance for real endpoints: Enforces rate limiting per endpoint type, includes IP blocking, and gracefully integrates reCAPTCHA v3 (skipping when not configured) to reduce brute-force and automated abuse.
  • Use case: Add or update authentication endpoints (signup, signin, verify-code, resend, forgot/reset password, signout, and protected “me/profile/admin” actions) while keeping security controls consistent and testable.

Quick Start

Ask for a guided walkthrough to implement or modify the email security-code signup→verify→dashboard flow using the existing security constants, hashing/verification, rate limiting, and session middleware in vue-ssr-auth.

Frequently Asked Questions about vue-ssr-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement email security-code authentication in a Vue SSR app?▼

Email security-code authentication in a Vue SSR app is implemented using a 6-digit code generated via crypto.randomInt, delivered by email, and verified before granting dashboard access. The flow covers signup, signin, verify-code, and password reset endpoints securely.

How does Vue SSR session management work with express-session?▼

Vue SSR session management uses express-session with a file-based store to maintain user sessions. It pairs with bcryptjs for password hashing and SHA-256 with timingSafeEqual for cryptographic code verification to ensure hardened session security.

Can I add rate limiting and IP blocking to Vue SSR authentication endpoints?▼

Yes, you can add rate limiting and IP blocking to Vue SSR authentication endpoints. The implementation enforces per-endpoint rate limits and includes IP blocking to provide abuse resistance against brute-force and automated attacks.

Does reCAPTCHA v3 work with Vue SSR signup and signin flows?▼

reCAPTCHA v3 works with Vue SSR signup and signin flows by gracefully integrating validation to reduce automated abuse. It skips automatically when not configured, ensuring the authentication flow remains functional without mandatory setup.

What is the best way to protect Vue SSR password reset endpoints from brute-force attacks?▼

The best way to protect Vue SSR password reset endpoints from brute-force attacks is combining per-endpoint rate limiting, IP blocking, and timing-safe cryptographic verification of security codes, optionally augmented by reCAPTCHA v3 validation.

Related Skills

Explore More Software Engineering Skills→
brandon-frysliebrandon-fryslie
4

share-slop

Upload Claude Code session JSONL to paste.slopspot.ai and generate a public read-only link.

Community
Basic
atilladenizatilladeniz
2

auth-pages

Implement passwordless Magic Link authentication with server-side session checks in Next.js 16.

Community
Intermediate
marquesfelipmarquesfelip

brute-force-protection

Enforce rate limits, lockouts, and MFA on authentication endpoints.

Community
Advanced
FortiumPartnersFortiumPartners

Smoke Test Auth Skill

Execute authentication and authorization smoke tests for login, token validation, and access control.

Official
Intermediate