# Authentication

> Assesses authentication flows, OAuth2 / OIDC implementations, session lifecycle management, and JWT security.

- Skill: `zyrexnn/authentication` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zyrexnn/authentication`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zyrexnn/authentication/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zyrexnn (https://skillmd.com/u/zyrexnn)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zyrexnn/authentication

---


# Authentication & Session Testing Skill

## Purpose
Inspect authentication mechanics, token handling, session invalidation, and privilege separation in web and mobile backends.

## Workflow
1. **Identify Auth Mechanisms**:
   - Cookie-based sessions (inspect `HttpOnly`, `Secure`, `SameSite` flags)
   - JWT tokens (Header: `alg`, Payload claims: `sub`, `exp`, `role`)
   - OAuth2 / OIDC flows (Redirect URI validation, `state` parameter presence, PKCE enforcement)
2. **Evaluate Common Flaws**:
   - **JWT Vulnerabilities**: Weak secret keys, `alg: none` handling, missing signature validation, token expiry validation.
   - **Session Lifecycle**: Does logging out invalidate the server-side session or JWT? Can old sessions be reused after password change?
   - **OAuth Flaws**: Open redirect on `redirect_uri`, CSRF due to missing or static `state`, token leakage via Referer headers.
   - **Password Reset Flows**: Predictable tokens, host header injection in reset links, account enumeration via timing/response differences.
3. **Document Flow & Observations**:
   Log sequence diagrams and HTTP traces for any identified authorization discrepancy.

## Safety Constraints
- Never lock out real accounts through brute force.
- Never alter production user passwords without explicit consent.