# Authentication Patterns

> Implement authentication and authorization securely — hashing, sessions, tokens, and permissions.

- Skill: `rahulrachhoya/authentication-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add rahulrachhoya/authentication-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rahulrachhoya/authentication-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: RahulRachhoya (https://skillmd.com/u/rahulrachhoya)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/rahulrachhoya/authentication-patterns

---


# Authentication Patterns

## Password Handling
- **Hash, don't encrypt** — use bcrypt, argon2, or scrypt. Never SHA-1/MD5
- **Salt every password** — unique salt per user (automatic with bcrypt/argon2)
- **Minimum requirements** — 8+ chars, no arbitrary complexity rules (those reduce entropy)
- **Rate limit login attempts** — prevent brute force

## Session vs Token Auth
| Aspect | Session | JWT |
|--------|---------|-----|
| State | Server-side | Client-side (stateless) |
| Storage | Cookie (HttpOnly) | LocalStorage / header |
| Revocation | Immediate | Until expiration (need blocklist) |
| Scaling | Shared session store needed | Built-in |
| Payload | Session ID only | Can include claims |

## Authorization
- **RBAC** — roles assigned to users, permissions assigned to roles
- **Attribute-based (ABAC)** — permissions based on user, resource, and context attributes
- **Least privilege** — grant minimum permissions needed

## Common Vulnerabilities
- JWT with `alg: none` — always verify the algorithm
- Tokens in URL parameters — use Authorization header
- No expiry on tokens — always set expiration, use refresh tokens
- Session fixation — regenerate session ID on login
- Missing 2FA/MFA on sensitive operations