authentication-system-example

Authentication System (Example)

Summary

Defines patterns for implementing user authentication including login, signup, session management, and protected routes. This is an example template - customize for your specific authentication needs.

Context

Authentication is a critical system that requires consistent patterns for security, user experience, and maintainability. This rule ensures all authentication-related code follows established patterns.

Instructions

Authentication Flow

1. User Registration

   • Collect required user information
   • Validate input data (email format, password strength)
   • Check for existing accounts
   • Create user record with hashed password
   • Send verification email (if required)
   • Auto-login or redirect to login

2. User Login

   • Validate credentials
   • Generate secure session token/JWT
   • Set secure HTTP-only cookies
   • Redirect to intended destination
   • Handle "remember me" functionality

3. Session Management

   • Validate tokens on protected routes
   • Refresh tokens before expiration
   • Handle logout (clear tokens/cookies)
   • Manage concurrent sessions

Security Patterns

• Password Hashing: Use bcrypt or similar secure hashing
• Token Security: Use JWT with proper expiration and signing
• HTTPS Only: All authentication requests over HTTPS
• Rate Limiting: Prevent brute force attacks
• Input Validation: Sanitize all user inputs
• CSRF Protection: Implement CSRF tokens for forms

Protected Routes

// Pattern for protected route middleware
function requireAuth(handler: RouteHandler) {
  return async (req, res) => {
    const token = extractTokenFromRequest(req);
    
    if (!token) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    
    try {
      const user = await validateToken(token);
      req.user = user;
      return handler(req, res);
    } catch (error) {
      return res.status(401).json({ error: 'Invalid token' });
    }
  };
}