auth-audit

Auth Audit

Scan the project's authentication and authorization implementation for security vulnerabilities.

Load the auth-patterns skill for authentication and authorization security patterns.

Usage

/auth-audit [--focus jwt|session|oauth|rbac|all]

Arguments

Parse $ARGUMENTS to extract:

• --focus (optional, default: all)
  • jwt — JWT implementation issues
  • session — Session management issues
  • oauth — OAuth2 implementation issues
  • rbac — Role/permission issues
  • all — Audit everything

Instructions

1. Detect Auth Implementation

Search for auth patterns:

grep -rn "jsonwebtoken\|jose\|jwt\|JWT" --include="*.ts" --include="*.js" 2>/dev/null
grep -rn "bcrypt\|argon2\|scrypt\|pbkdf2" --include="*.ts" --include="*.js" 2>/dev/null
grep -rn "passport\|next-auth\|lucia\|clerk\|auth0\|supabase.*auth" --include="*.ts" --include="*.js" 2>/dev/null
grep -rn "session\|cookie\|Set-Cookie" --include="*.ts" --include="*.js" 2>/dev/null
grep -rn "role\|permission\|authorize\|canAccess\|isAdmin" --include="*.ts" --include="*.js" 2>/dev/null

2. JWT Audit

If JWT is used, check for:

Critical:

• Weak or hardcoded secret key (secret in source code, short key, "secret")
• Algorithm confusion (accepting none, not verifying alg header)
• Missing token expiration (exp claim)
• Token stored in localStorage (XSS-accessible)
• Secret in client-side code

High:

• No token refresh mechanism (long-lived access tokens)
• Missing iss (issuer) validation
• Missing aud (audience) validation
• Token not invalidated on password change
• No token revocation mechanism (logout doesn't invalidate)

Medium:

• Using HS256 when RS256 is more appropriate (multi-service)
• Excessive token payload (PII, roles should be verified server-side)
• Missing jti for token uniqueness

3. Password Audit

Check for:

• Weak hashing (MD5, SHA1, SHA256 without salt)
• Missing salt (even with bcrypt, verify rounds ≥ 10)
• Password stored in plaintext
• No minimum password requirements enforced
• Missing rate limiting on login endpoint
• Missing account lockout after failed attempts
• Password comparison using === instead of timing-safe compare