auth

Authentication

Implement secure authentication for web applications with framework-appropriate providers.

Provider Selection

Select provider based on framework and backend:

Framework	Default Provider	If Using Supabase Backend
Next.js	NextAuth	Supabase Auth
Express	Passport.js	Supabase Auth
Go	golang-jwt	Supabase Auth
React (SPA)	Depends on backend	Supabase Auth

Decision rule: If user selected Supabase for database/storage, use Supabase Auth. Otherwise, use framework default.

Workflow

1. Detect or confirm framework - Ask if unclear
2. Check backend choice - If Supabase, recommend Supabase Auth
3. Select auth provider - Based on matrix above
4. Generate auth configuration - Provider setup, env vars
5. Create middleware/guards - Route protection
6. Generate protected route patterns - Apply to API routes
7. Add session management - Token refresh, logout

Implementation by Framework

Next.js

See references/nextjs.md for:

• NextAuth setup with providers (Google, GitHub, credentials)
• Middleware-based route protection
• Server component auth checks
• API route protection

Express

See references/express.md for:

• Passport.js strategy configuration
• Session vs JWT authentication
• Route middleware patterns
• Token refresh handling

Go

See references/go.md for:

• golang-jwt token generation and validation
• Middleware patterns for protected routes
• Session management options
• Secure cookie handling

Supabase (Any Framework)

See references/supabase.md for:

• Supabase Auth client setup
• Row Level Security (RLS) patterns
• Session handling across frameworks
• OAuth provider configuration

Security Requirements

All implementations must include:

1. Secure token storage - HttpOnly cookies preferred over localStorage
2. CSRF protection - Required for cookie-based auth
3. Token expiration - Access tokens < 15min, refresh tokens < 7 days
4. Secure headers - Set appropriate security headers
5. Input validation - Validate all auth inputs server-side
6. Rate limiting - Protect login endpoints from brute force