Authentication Patterns
FreeMaster secure authentication and authorization systems.
Free · Opens the source repo
What Authentication Patterns does
The Authentication & Authorization Implementation Patterns skill provides developers with a comprehensive guide to building secure and scalable authentication and authorization systems. It covers essential concepts such as authentication (AuthN) and authorization (AuthZ), detailing the differences and their respective roles in access control. Users can learn about various authentication strategies, including session-based and token-based methods like JWT, as well as OAuth2 and OpenID Connect for delegated authentication and social logins.
This skill is particularly useful for those implementing user authentication systems, securing REST or GraphQL APIs, and adding features like OAuth2 or role-based access control (RBAC). It also addresses common scenarios such as session management, migrating authentication systems, and debugging authentication issues. By following the provided best practices, developers can ensure their applications are secure against common vulnerabilities and follow industry standards.
In addition to the core concepts, the skill includes detailed patterns and worked examples available in the bundled references/details.md file. This resource serves as a deeper dive into specific implementation patterns, making it easier for developers to apply the knowledge effectively in real-world situations. The skill emphasizes the importance of security measures, such as hashing passwords, using HTTPS, and implementing multi-factor authentication (MFA), to protect user data and maintain system integrity.
Overall, this skill is designed for developers and designers who need to implement robust authentication and authorization mechanisms in their applications, ensuring a secure user experience while managing access control efficiently.
When to use it
Use this skill when building or securing user authentication systems, especially for APIs or applications requiring role-based access control.
When not to use it
This skill may not be suitable for simple applications that do not require advanced authentication mechanisms or for those who are not familiar with security practices.
What you can build with it
Implementing OAuth2 Login
Use this skill to integrate OAuth2 for social login options like Google or GitHub, enhancing user experience.
Securing REST APIs
Apply the authentication patterns to secure your REST APIs, ensuring that only authorized users can access sensitive endpoints.
Debugging Authentication Issues
Utilize the guidelines provided to troubleshoot and resolve common authentication problems in your applications.
How to install Authentication Patterns
View source1. Install with the skills CLI
npx skills add wshobson/agents/auth-implementation-patterns --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by wshobsonAuthentication & Authorization Implementation Patterns
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
When to Use This Skill
- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login
- Implementing role-based access control (RBAC)
- Designing session management
- Migrating authentication systems
- Debugging auth issues
- Implementing SSO or multi-tenancy
Core Concepts
1. Authentication vs Authorization
Authentication (AuthN): Who are you?
- Verifying identity (username/password, OAuth, biometrics)
- Issuing credentials (sessions, tokens)
- Managing login/logout
Authorization (AuthZ): What can you do?
- Permission checking
- Role-based access control (RBAC)
- Resource ownership validation
- Policy enforcement
2. Authentication Strategies
Session-Based:
- Server stores session state
- Session ID in cookie
- Traditional, simple, stateful
Token-Based (JWT):
- Stateless, self-contained
- Scales horizontally
- Can store claims
OAuth2/OpenID Connect:
- Delegate authentication
- Social login (Google, GitHub)
- Enterprise SSO
Detailed patterns and worked examples
Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.
Best Practices
- Never Store Plain Passwords: Always hash with bcrypt/argon2
- Use HTTPS: Encrypt data in transit
- Short-Lived Access Tokens: 15-30 minutes max
- Secure Cookies: httpOnly, secure, sameSite flags
- Validate All Input: Email format, password strength
- Rate Limit Auth Endpoints: Prevent brute force attacks
- Implement CSRF Protection: For session-based auth
- Rotate Secrets Regularly: JWT secrets, session secrets
- Log Security Events: Login attempts, failed auth
- Use MFA When Possible: Extra security layer
Common Pitfalls
- Weak Passwords: Enforce strong password policies
- JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
- No Token Expiration: Tokens should expire
- Client-Side Auth Checks Only: Always validate server-side
- Insecure Password Reset: Use secure tokens with expiration
- No Rate Limiting: Vulnerable to brute force
- Trusting Client Data: Always validate on server
Frequently asked questions about Authentication Patterns
Similar skills
GitHub Actions Hardening
Enhance the security of your GitHub Actions workflows.
Sensitive Logging Audit
Audit and fix sensitive data exposure in Python logging.
Android App Static Analysis
Automate security assessments of Android apps with MobSF.
Integrating DAST with OWASP ZAP
Seamlessly integrate dynamic security testing into CI/CD pipelines.
Implementing Runtime Security with Tetragon
Enhance Kubernetes security with eBPF-based observability.
Implementing Mobile Application Management
Secure enterprise data on mobile devices with app-level controls.