auth-security

Auth & Security

When to Apply

• Classification: ALL classifications that touch auth, permissions, user data, or session management
• Phase: /plan (auth flow design), /implement (auth logic), /review (MANDATORY for any auth-related change), /test (auth bypass testing)
• Trigger: Task involves login, registration, password, token, session, role, permission, or access control

Relationship to Security Guardrails

This skill extends .agent/rules/security_guardrails.md with APP-specific auth patterns. The security guardrails handle OWASP scanning and secret detection. This skill handles auth architecture and implementation patterns.

Precedence: security_guardrails.md > this skill. If conflict, security guardrails win.

Conventions

Customize after /app-init: Replace these with your project's ADR auth decisions.

Authentication Flow (JWT Example)

Client                    Server                     DB
  |-- POST /auth/login -->|                           |
  |   {email, password}   |-- verify password hash -->|
  |                       |<-- user record -----------|
  |<-- {access_token,     |                           |
  |     refresh_token} ---|                           |
  |                       |                           |
  |-- GET /api/resource ->|                           |
  |   Authorization:      |-- verify token            |
  |   Bearer <access>     |-- check permissions       |
  |<-- 200 data ---------|                           |
  |                       |                           |
  |-- POST /auth/refresh->|                           |
  |   {refresh_token}     |-- verify + rotate ------->|
  |<-- {new_access,       |<-- new tokens ------------|
  |     new_refresh} -----|                           |

Token Rules

• Access token: Short-lived (15-30 min). Stored in memory only (NOT localStorage).
• Refresh token: Longer-lived (7-30 days). Stored in httpOnly, secure, sameSite cookie.
• Token rotation: Issue new refresh token on each refresh. Invalidate old one.
• Revocation: Maintain a blocklist for compromised tokens (or use short expiry + DB check).