# Kirby Security And Auth

> Secures Kirby sites with access restriction, user roles, permissions, and protected downloads. Use when implementing login/role-based access, permissions, or file protection. Use when this capability is needed.

- Skill: `tomevault-io/kirby-security-and-auth` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/kirby-security-and-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kirby-security-and-auth/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/kirby-security-and-auth

---


# Kirby Security and Auth

## KB entry points

- `kirby://kb/scenarios/62-access-restriction-login`
- `kirby://kb/scenarios/43-user-registration-and-login`
- `kirby://kb/scenarios/63-files-firewall-protected-downloads`
- `kirby://kb/scenarios/64-permission-tricks-role-based`
- `kirby://kb/scenarios/67-indieauth-rel-me`

## Required inputs

- Protected pages/data and required roles.
- Login/logout flow and redirect rules.
- Download protection or route constraints.

## Role matrix template

| Role   | Pages | Actions | Downloads |
| ------ | ----- | ------- | --------- |
| admin  | all   | all     | all       |
| editor | edit  | publish | limited   |

## Default guard pattern

- Check `$kirby->user()` and required role/permission before returning content.
- Redirect or return a 403 for unauthorized requests.
- Enforce CSRF and validation on auth-related forms.

## Login redirect rule

- Store intended URL in the session and redirect after successful login.
- Fall back to the home page when no intent is stored.

## Common pitfalls

- Checking access only in templates while routes remain public.
- Returning a 404 for unauthorized access instead of a 403 or redirect.

## Verification checklist

- Test the role matrix across protected pages and downloads.
- Verify login/logout flows and session handling.
- Confirm CSRF failures render safely.

## Workflow

1. Clarify which pages/data are protected, required roles, and login/logout behavior.
2. Call `kirby:kirby_init` and read `kirby://roots`.
3. Inspect templates/controllers/blueprints to align with existing patterns:
   - `kirby:kirby_templates_index`
   - `kirby:kirby_controllers_index`
   - `kirby:kirby_blueprints_index`
4. For protected downloads or auth routes, inspect routes with `kirby:kirby_routes_index` and `kirby://config/routes` (install runtime if needed).
5. Search the KB with `kirby:kirby_search` (examples: "access restriction login", "user registration and login", "files firewall", "permission tricks", "page on own domain").
6. Implement least-privilege checks in templates/controllers or routes; enforce CSRF and validation on auth forms.
7. Verify by rendering protected pages (`kirby:kirby_render_page`) and manually testing login and download URLs.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/bnomei) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->