# Auth

> Authentication & Authorization Skill

- Skill: `ab-aswini/auth` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ab-aswini/auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ab-aswini/auth/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Ab-aswini (https://skillmd.com/u/ab-aswini)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/ab-aswini/auth

---

# Authentication & Authorization Skill

> Loaded by: BE-005 (Auth), BE-006 (RBAC) | Version: 1.0

## Password Handling

- Hash with bcrypt (cost >= 12) or argon2; NEVER store plaintext
- NEVER log passwords; implement password complexity rules

## JWT Tokens

- Access tokens: 15-30 min expiry
- Refresh tokens: 7-30 days, rotate on use
- Minimal claims in payload; NEVER put sensitive data in JWT

## Session Management

- HTTP-only, Secure, SameSite cookies
- Implement session invalidation and track active sessions

## Pattern

```python
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def hash_password(password: str) -> str:
    return pwd_context.hash(password)

def verify_password(plain: str, hashed: str) -> bool:
    return pwd_context.verify(plain, hashed)
```

## Anti-Patterns

- Do NOT implement custom crypto
- Do NOT store tokens in localStorage
- Do NOT skip token validation on protected endpoints
- Do NOT use MD5/SHA1 for passwords
- Do NOT send tokens in URL parameters

## Checklist

- [ ] Passwords hashed with bcrypt/argon2
- [ ] JWT expiry is short and reasonable
- [ ] Refresh tokens rotate on use
- [ ] No sensitive data in tokens
- [ ] HTTPS enforced; brute force protection in place