How do I install the Auth Implementation Patterns skill?

Run npx skillmds add sickn33/auth-implementation-patterns in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Auth Implementation Patterns safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Auth Implementation Patterns?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Auth Implementation Patterns free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Auth Implementation Patterns?

sickn33 (@sickn33) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Auth Implementation Patterns by sickn33

Name: Auth Implementation Patterns
Rating: 4.5 (4 reviews)
Author: sickn33

File contents

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

Use this skill when

Implementing user authentication systems
Securing REST or GraphQL APIs
Adding OAuth2/social login or SSO
Designing session management or RBAC
Debugging authentication or authorization issues

Do not use this skill when

You only need UI copy or login page styling
The task is infrastructure-only without identity concerns
You cannot change auth policies or credential storage

Instructions

Define users, tenants, flows, and threat model constraints.
Choose auth strategy (session, JWT, OIDC) and token lifecycle.
Design authorization model and policy enforcement points.
Plan secrets storage, rotation, logging, and audit requirements.
If detailed examples are required, open resources/implementation-playbook.md.

Safety

Never log secrets, tokens, or credentials.
Enforce least privilege and secure storage for keys.

Resources

resources/implementation-playbook.md for detailed patterns and examples.

Worked example

Input: an Express application accepts a user's login and keeps the pre-login session ID. Read the bundled playbook, regenerate the session after credential verification, save only required identity fields, and verify that the old cookie cannot access /api/profile. Also test failed login, logout and store failure. Expected: successful login changes the session ID; failed login grants no access.

Inputs and prerequisites

Record the installed framework/SDK versions, identity provider, tenant model, credential store and test environment. Supply project-specific database adapters and request schemas; examples are integration sketches, not a runnable identity service.

Limitations

JWT validation does not establish resource ownership; enforce tenant and object policy on reads and writes.
Refresh rotation requires atomic persistence and concurrency tests; the issuance example alone does not provide it.
Cookie flags do not replace CSRF protection, and secure-cookie behavior needs the actual HTTPS/proxy configuration tested.
Provider integrations and password policies must be checked against current primary documentation and the application's threat model.

---name: auth-implementation-patternsdescription: Implement or review authentication and authorization with explicit token, session and resource-access boundaries.--- # Authentication & Authorization Implementation Patterns Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices. ## Use this skill when - Implementing user authentication systems - Securing REST or GraphQL APIs - Adding OAuth2/social login or SSO - Designing session management or RBAC - Debugging authentication or authorization issues ## Do not use this skill when - You only need UI copy or login page styling - The task is infrastructure-only without identity concerns - You cannot change auth policies or credential storage ## Instructions - Define users, tenants, flows, and threat model constraints. - Choose auth strategy (session, JWT, OIDC) and token lifecycle. - Design authorization model and policy enforcement points. - Plan secrets storage, rotation, logging, and audit requirements. - If detailed examples are required, open `resources/implementation-playbook.md`. ## Safety - Never log secrets, tokens, or credentials. - Enforce least privilege and secure storage for keys. ## Resources - `resources/implementation-playbook.md` for detailed patterns and examples. ## Worked example Input: an Express application accepts a user's login and keeps the pre-login session ID. Read the bundled playbook, regenerate the session after credential verification, save only required identity fields, and verify that the old cookie cannot access `/api/profile`. Also test failed login, logout and store failure. Expected: successful login changes the session ID; failed login grants no access. ## Inputs and prerequisites Record the installed framework/SDK versions, identity provider, tenant model, credential store and test environment. Supply project-specific database adapters and request schemas; examples are integration sketches, not a runnable identity service. ## Limitations - JWT validation does not establish resource ownership; enforce tenant and object policy on reads and writes. - Refresh rotation requires atomic persistence and concurrency tests; the issuance example alone does not provide it. - Cookie flags do not replace CSRF protection, and secure-cookie behavior needs the actual HTTPS/proxy configuration tested. - Provider integrations and password policies must be checked against current primary documentation and the application's threat model.

Frequently asked questions