# Fujigo Software F5 Framework Claude Security Auth

> Security Auth Skill

- Skill: `tomevault-io/fujigo-software-f5-framework-claude-security-auth` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/fujigo-software-f5-framework-claude-security-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/fujigo-software-f5-framework-claude-security-auth/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/fujigo-software-f5-framework-claude-security-auth

---


# Security Auth Skill

Authentication and authorization patterns for secure applications.

## Quick Reference

### Authentication Methods

| Method | Use Case | Security Level |
|--------|----------|----------------|
| JWT + Refresh | SPAs, Mobile apps | High |
| Session cookies | Traditional web apps | High |
| OAuth2/OIDC | Social login, SSO | High |
| API Keys | Service-to-service | Medium |
| MFA | High-security apps | Very High |

### Authorization Patterns

| Pattern | Use Case | Complexity |
|---------|----------|------------|
| RBAC | Most applications | Low-Medium |
| ABAC | Fine-grained control | High |
| ReBAC | Relationship-based | Medium |
| Permission Matrix | Admin panels | Low |

## JWT Token Service

```typescript
export class TokenService {
  private readonly accessExpiry = '15m';   // Short-lived
  private readonly refreshExpiry = '7d';   // Rotate on use

  generateTokenPair(user: User): TokenPair {
    const accessToken = jwt.sign(
      { sub: user.id, type: 'access' },
      this.accessSecret,
      { expiresIn: this.accessExpiry }
    );

    const refreshToken = jwt.sign(
      { sub: user.id, type: 'refresh' },
      this.refreshSecret,
      { expiresIn: this.refreshExpiry }
    );

    return { accessToken, refreshToken };
  }
}
```

## Password Hashing

```typescript
import bcrypt from 'bcrypt';

// Hash password (cost factor 12)
const hash = await bcrypt.hash(password, 12);

// Verify password
const isValid = await bcrypt.verify(password, hash);
```

## RBAC Guard (NestJS)

```typescript
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<Role[]>(
      ROLES_KEY, [context.getHandler(), context.getClass()]
    );
    if (!requiredRoles) return true;
    const { user } = context.switchToHttp().getRequest();
    return requiredRoles.some(role => user.roles?.includes(role));
  }
}
```

## OAuth2/OIDC Flow

```typescript
// Passport OAuth2 Strategy
passport.use(new OAuth2Strategy({
  authorizationURL: 'https://provider.com/oauth2/authorize',
  tokenURL: 'https://provider.com/oauth2/token',
  clientID: process.env.CLIENT_ID,
  clientSecret: process.env.CLIENT_SECRET,
  callbackURL: '/auth/callback',
}, (accessToken, refreshToken, profile, done) => {
  return done(null, profile);
}));
```

## Anti-Patterns

```typescript
// Storing passwords in plain text
user.password = plainPassword; // NEVER DO THIS

// Missing rate limiting on auth
app.post('/login', loginHandler); // ADD RATE LIMITING

// Long-lived access tokens
{ expiresIn: '30d' } // TOO LONG - use 15m max
```

## F5 Quality Gates

| Gate | Requirement |
|------|-------------|
| G2 | Auth requirements documented |
| G2.5 | Auth controls implemented |
| G3 | Auth tests passing (90%+ coverage) |

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/fujigo-software) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->