🔑 Core Philosophy: Trust must be earned and constantly verified.
When to use
Use this skill when designing sign-in flows, implementing role-based or attribute-based access control (RBAC/ABAC), securing API endpoints, managing JWT lifecycle, storing tokens, and integrating identity providers (IdPs) like Apple Sign-In or Passkeys.
When not to use
Do not use this skill for basic visual layout of forms, telemetry logs, or general database schema indexing unrelated to security.
Trigger cues
- Key terms: authentication, authorization, OAuth, OIDC, JWT, token, Keychain, HttpOnly, Passkey, WebAuthn, OAuth 2.1, PKCE, MFA, SAML, RBAC, session, secure storage.
- Implementing login, token decryption/signature verification, setting up middleware cookies, or handling authorization headers.
Routing boundary
- Primary for security flows, authentication mechanics, credential storage, and authorization verification.
- Secondary to
developer-web-security for broader transport and network defenses.
Inputs required
- Selected identity system (e.g., OAuth 2.1 authorization server, Cognito, Firebase Auth)
- Security requirements (e.g., PCI-DSS, GDPR, platform guidelines)
- Source of truth:
references/source.md
Instructions
- Detect Stack: Inspect the workspace files to identify the project's existing identity and authentication tools (e.g., NextAuth, Passport, Auth0, Firebase Auth, Firebase Admin).
- Do Not Migrate: Never propose or force a technology stack change. Apply the principles in this skill using the project's current tooling.
- Read references/source.md to understand first-principles identity and authorization security.
- Standardize on OAuth 2.1 flows with PKCE enabled for all native and public clients within the project's framework.
- Validate incoming JWTs cryptographically (verifying issuer, audience, and signature algorithm).
- Store client-side credentials in secure sandboxes (iOS Keychain or HttpOnly/Secure/SameSite cookies).
- Enforce Passkey support using WebAuthn APIs for high-security, passwordless entry.
Completion gate
Before reporting completion, verify the applicable binary contracts in evals/cases.json: complete JWT validation, Authorization Code with PKCE for public clients, no embedded public-client secret, and platform-appropriate secure credential storage.
Output format
- Primary decision/output: Authentication flow diagrams, token storage design, and authorization policy code.
- Summary: One-paragraph overview of identity and token security.
- Actions: Verification checklist for threat modeling and secure credential management.
1---2name: auth-and-identity-rules3description: Trigger: OAuth 2.1, JWT session, Secure cookies, Keychain storage, auth flow, user authentication. Scope: User authentication, session storage, authorization boundaries. Boundary: Excludes generic data caching.4---56# 🔑 Core Philosophy: Trust must be earned and constantly verified.78## When to use910Use this skill when designing sign-in flows, implementing role-based or attribute-based access control (RBAC/ABAC), securing API endpoints, managing JWT lifecycle, storing tokens, and integrating identity providers (IdPs) like Apple Sign-In or Passkeys.1112## When not to use1314Do not use this skill for basic visual layout of forms, telemetry logs, or general database schema indexing unrelated to security.1516## Trigger cues1718- Key terms: authentication, authorization, OAuth, OIDC, JWT, token, Keychain, HttpOnly, Passkey, WebAuthn, OAuth 2.1, PKCE, MFA, SAML, RBAC, session, secure storage.19- Implementing login, token decryption/signature verification, setting up middleware cookies, or handling authorization headers.2021## Routing boundary2223- Primary for security flows, authentication mechanics, credential storage, and authorization verification.24- Secondary to `developer-web-security` for broader transport and network defenses.2526## Inputs required2728- Selected identity system (e.g., OAuth 2.1 authorization server, Cognito, Firebase Auth)29- Security requirements (e.g., PCI-DSS, GDPR, platform guidelines)30- Source of truth: `references/source.md`3132## Instructions33341. **Detect Stack**: Inspect the workspace files to identify the project's existing identity and authentication tools (e.g., NextAuth, Passport, Auth0, Firebase Auth, Firebase Admin).352. **Do Not Migrate**: Never propose or force a technology stack change. Apply the principles in this skill using the project's current tooling.363. Read [references/source.md](references/source.md) to understand first-principles identity and authorization security.374. Standardize on OAuth 2.1 flows with PKCE enabled for all native and public clients within the project's framework.385. Validate incoming JWTs cryptographically (verifying issuer, audience, and signature algorithm).396. Store client-side credentials in secure sandboxes (iOS Keychain or HttpOnly/Secure/SameSite cookies).407. Enforce Passkey support using WebAuthn APIs for high-security, passwordless entry.4142## Completion gate4344Before reporting completion, verify the applicable binary contracts in `evals/cases.json`: complete JWT validation, Authorization Code with PKCE for public clients, no embedded public-client secret, and platform-appropriate secure credential storage.4546## Output format4748- Primary decision/output: Authentication flow diagrams, token storage design, and authorization policy code.49- Summary: One-paragraph overview of identity and token security.50- Actions: Verification checklist for threat modeling and secure credential management.
coreyone