authentication-authorization-skill

What I do

I help you implement secure authentication and authorization systems:

1. OAuth2/OIDC: Authorization code, client credentials, PKCE flows
2. JWT: Token creation, validation, rotation, and best practices
3. Session Management: Secure session handling and storage
4. RBAC/ABAC: Role-based and attribute-based access control
5. Framework Integration: NextAuth/Auth.js, Passport.js, FastAPI security
6. Password Security: Hashing, salting, and password policies
7. CSRF Protection: Token-based and same-site cookie patterns

When to use me

Use this skill when:

• Implementing login/signup flows
• Setting up OAuth2 social login (Google, GitHub, etc.)
• Designing role-based access control
• Configuring JWT token management
• Integrating NextAuth/Auth.js or Passport.js
• Implementing API authentication middleware
• Setting up password hashing and verification
• Adding CSRF protection to forms
• Implementing multi-factor authentication

Related Skills

• security-audit-skill: Handles security auditing and vulnerability scanning. This skill handles auth implementation. CSRF here focuses on implementation patterns; security-audit focuses on detecting CSRF vulnerabilities.
• api-design-skill: API endpoint design. This skill handles authentication middleware for those endpoints.
• nextjs-standard-setup-skill: Project scaffolding that may include auth setup.

---

Step 1: OAuth2/OIDC Flows

Flow Selection

Flow	Use Case	Client Type
Authorization Code + PKCE	SPAs, mobile apps	Public
Authorization Code	Server-side web apps	Confidential
Client Credentials	Service-to-service	Confidential
Device Code	CLI tools, IoT	Public

Authorization Code + PKCE (Next.js)

import NextAuth from "next-auth"
import Google from "next-auth/providers/google"

export const { handlers, signIn, signOut, auth } = NextAuth({
  providers: [
    Google({
      clientId: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    }),
  ],
  pages: {
    signIn: "/login",
    error: "/login",
  },
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token.id = user.id
        token.role = user.role
      }
      return token
    },
    async session({ session, token }) {
      session.user.id = token.id
      session.user.role = token.role
      return session
    },
  },
  session: {
    strategy: "jwt",
    maxAge: 24 * 60 * 60,
  },
})