# Auth Patterns

> Skill: Authentication & Authorization Patterns

- Skill: `sawrus/auth-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sawrus/auth-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sawrus/auth-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sawrus (https://skillmd.com/u/sawrus)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/sawrus/auth-patterns

---

# Skill: Authentication & Authorization Patterns

## When to load

When implementing login, token management, OAuth integration, RBAC, or reviewing auth code.

## JWT Best Practices

```python
def create_access_token(user_id: str) -> str:
    return jwt.encode(
        payload={
            "sub": user_id,
            "iat": datetime.utcnow(),
            "exp": datetime.utcnow() + timedelta(minutes=15),  # Short expiry
            "jti": str(uuid.uuid4()),  # Unique ID for revocation
            "type": "access",          # Prevent refresh token as access token
        },
        key=settings.JWT_PRIVATE_KEY,
        algorithm="RS256",  # Asymmetric. Never HS256 in distributed systems.
    )
```

**Anti-patterns**: No `exp` claim; storing JWT in `localStorage`; using `alg: none`; sensitive data in payload.

## RBAC Pattern

```python
PERMISSIONS = {
    "invoices:read":   ["viewer", "editor", "admin"],
    "invoices:create": ["editor", "admin"],
    "invoices:delete": ["admin"],
}

def require_permission(permission: str):
    def dependency(current_user: User = Depends(get_current_user)):
        allowed_roles = PERMISSIONS.get(permission, [])
        if current_user.role not in allowed_roles:
            raise HTTPException(status_code=403)
        return current_user
    return dependency
```