auth-implementation-patterns
- Use it when:
- You're adding login, securing an API, adding Google or GitHub sign-in, setting up roles and permissions, or debugging an auth problem.
- It does:
- Explains authentication versus authorization and when to use sessions, JWTs or OAuth2, with TypeScript and Express examples for each.
- You get:
- Auth code that hashes passwords, keeps access tokens short-lived, sets secure cookies and rate-limits login endpoints.
- Avoids:
- JWTs in localStorage, tokens that never expire, checks made only on the client, insecure password resets and login endpoints without rate limits.
TL;DR
A reference for building access control. Authentication answers who you are; authorization, what you may do. Sessions keep state on the server behind a cookie; JWTs are stateless and scale horizontally; OAuth2 and OpenID Connect hand login to Google, GitHub or an enterprise single sign-on. The worked examples, in TypeScript with Express, cover issuing and verifying JWTs with a refresh-token flow, sessions stored in Redis, Google and GitHub login through Passport.js, role-based and permission-based access control, resource ownership checks, password hashing with bcrypt and input validation with Zod, and rate limiting. Its rules: never store plain passwords, keep access tokens to 15-30 minutes, set httpOnly, secure and sameSite on cookies, protect session-based auth against CSRF, rotate secrets, log security events and use MFA when possible.
Summarizes the skill at 4bde316.
npx skills add https://github.com/wshobson/agents --skill auth-implementation-patterns skills.sh pageSource on GitHubAll skills from wshobson/agents
- Total Downloads
- 20,800 on skills.sh, Nov 9, 2026
- Repo stars
- 42,334 wshobson/agents
- First seen
- Jan 20, 2026 on skills.sh
Weekly values
| Week to | Installs |
|---|---|
| Sep 21 | 719 |
| Sep 28 | 1,023 |
| Oct 5 | 1,145 |
| Oct 12 | 798 |
| Oct 19 | 716 |
| Oct 26 | 796 |
| Nov 2 | 773 |
| Nov 9 | 456 |
| Category |
Compliance, guardrails, skill vetting and browser fingerprinting. Test-first work, implementation from specs, git hygiene and scope control. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills. |
|---|---|
| Type |
Knowledge and rules the agent applies while it works: best practices, design principles, API references. |
| Effect |
Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code. |
| Needs |
Instructions only. Works in any agent that supports skills. |
| Publisher |
Everyone else. Unverified vendor claims default to community. |
| Topics | |
| Stack |
SKILL.md
From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.
Frontmatter
name: auth-implementation-patterns
description: Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.Authentication & Authorization Implementation Patterns
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
When to Use This Skill
- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login
- Implementing role-based access control (RBAC)
- Designing session management
- Migrating authentication systems
- Debugging auth issues
- Implementing SSO or multi-tenancy
Core Concepts
1. Authentication vs Authorization
Authentication (AuthN): Who are you?
- Verifying identity (username/password, OAuth, biometrics)
- Issuing credentials (sessions, tokens)
- Managing login/logout
Authorization (AuthZ): What can you do?
- Permission checking
- Role-based access control (RBAC)
- Resource ownership validation
- Policy enforcement
2. Authentication Strategies
Session-Based:
- Server stores session state
- Session ID in cookie
- Traditional, simple, stateful
Token-Based (JWT):
- Stateless, self-contained
- Scales horizontally
- Can store claims
OAuth2/OpenID Connect:
- Delegate authentication
- Social login (Google, GitHub)
- Enterprise SSO
Detailed patterns and worked examples
Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.
Best Practices
- Never Store Plain Passwords: Always hash with bcrypt/argon2
- Use HTTPS: Encrypt data in transit
- Short-Lived Access Tokens: 15-30 minutes max
- Secure Cookies: httpOnly, secure, sameSite flags
- Validate All Input: Email format, password strength
- Rate Limit Auth Endpoints: Prevent brute force attacks
- Implement CSRF Protection: For session-based auth
- Rotate Secrets Regularly: JWT secrets, session secrets
- Log Security Events: Login attempts, failed auth
- Use MFA When Possible: Extra security layer
Common Pitfalls
- Weak Passwords: Enforce strong password policies
- JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
- No Token Expiration: Tokens should expire
- Client-Side Auth Checks Only: Always validate server-side
- Insecure Password Reset: Use secure tokens with expiration
- No Rate Limiting: Vulnerable to brute force
- Trusting Client Data: Always validate on server