AutoGineer
Generated banner for Auth Implementation Patterns
Generated logo for Auth Implementation Patterns

Auth Implementation Patterns

Seth HobsonCommunityCreated by Seth Hobson

  • Skill
  • Guidelines
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a comprehensive framework for implementing robust authentication and authorization systems. It covers the fundamental distinction between verifying identity (AuthN) and enforcing permissions (AuthZ), while detailing modern strategies like session-based management, JWT-based stateless tokens, and OAuth2/OpenID Connect. The content emphasizes security best practices, such as secure password hashing, token lifecycle management, and common pitfalls to avoid during implementation.

What it does

  • Defines core concepts of authentication and authorization
  • Provides implementation patterns for JWT and refresh token flows
  • Outlines security best practices for credential and session management
  • Offers guidance on integrating OAuth2 and OpenID Connect
  • Highlights common security pitfalls and how to mitigate them
  • Includes code examples for token generation, verification, and middleware integration

When to use it

  • When building new user authentication systems
  • When securing REST or GraphQL APIs
  • When implementing role-based access control (RBAC)
  • When designing session management or SSO solutions
  • When debugging existing authentication issues
  • When migrating or upgrading legacy auth systems

Advantages

  • Promotes industry-standard security practices
  • Reduces risk of common vulnerabilities like XSS or brute force
  • Provides clear, actionable patterns for stateless and stateful auth
  • Includes practical code examples for immediate application
  • Helps ensure scalable and maintainable access control

Usage examples

“How should I implement a secure JWT-based authentication flow for my API?”
The agent provides a pattern for generating short-lived access tokens and long-lived refresh tokens, including middleware for server-side validation.
“What are the best practices for storing passwords and managing sessions?”
The agent outlines requirements for using bcrypt/argon2 for hashing, enforcing HTTPS, and utilizing httpOnly cookies for session management.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/wshobson/auth-implementation-patterns/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip auth-implementation-patterns.zip -d .agents/skills

Documentation by Seth Hobson

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

  • Implementing user authentication systems

  • Securing REST or GraphQL APIs

  • Adding OAuth2/social login

  • Implementing role-based access control (RBAC)

  • Designing session management

  • Migrating authentication systems

  • Debugging auth issues

  • Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

  • Verifying identity (username/password, OAuth, biometrics)

  • Issuing credentials (sessions, tokens)

  • Managing login/logout

Authorization (AuthZ): What can you do?

  • Permission checking

  • Role-based access control (RBAC)

  • Resource ownership validation

  • Policy enforcement

2. Authentication Strategies

Session-Based:

  • Server stores session state

  • Session ID in cookie

  • Traditional, simple, stateful

Token-Based (JWT):

  • Stateless, self-contained

  • Scales horizontally

  • Can store claims

OAuth2/OpenID Connect:

  • Delegate authentication

  • Social login (Google, GitHub)

  • Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

  1. Never Store Plain Passwords: Always hash with bcrypt/argon2

  2. Use HTTPS: Encrypt data in transit

  3. Short-Lived Access Tokens: 15-30 minutes max

  4. Secure Cookies: httpOnly, secure, sameSite flags

  5. Validate All Input: Email format, password strength

  6. Rate Limit Auth Endpoints: Prevent brute force attacks

  7. Implement CSRF Protection: For session-based auth

  8. Rotate Secrets Regularly: JWT secrets, session secrets

  9. Log Security Events: Login attempts, failed auth

  10. Use MFA When Possible: Extra security layer

Common Pitfalls

  • Weak Passwords: Enforce strong password policies

  • JWT in localStorage: Vulnerable to XSS, use httpOnly cookies

  • No Token Expiration: Tokens should expire

  • Client-Side Auth Checks Only: Always validate server-side

  • Insecure Password Reset: Use secure tokens with expiration

  • No Rate Limiting: Vulnerable to brute force

  • Trusting Client Data: Always validate on server

Files

LICENSE

MIT License

Copyright (c) 2024 Seth Hobson

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/developer-essentials/skills/auth-implementation-patterns · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download auth-implementation-patterns.zip