web-auth
Implement React Web Authentication
React teams need secure authentication flows that handle sessions, redirects, OAuth, and token refresh correctly. This skill gives Claude, Codex, and Claude Code practical patterns for building those flows in web apps.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "web-auth" from https://skillstore.io/skills/cjharmath-web-auth.md and its manifest at https://skillstore.io/api/skills/cjharmath-web-auth/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "web-auth". I need login and logout in a React app using cookies.
Expected outcome:
A concise implementation plan with an API client, auth provider, loading state, login form connection, and logout cleanup.
Using "web-auth". I want to add Google sign-in to a Next.js app.
Expected outcome:
Provider setup guidance, environment variable names, callback behavior, session handling, and dashboard protection steps.
Using "web-auth". Check my authentication flow for common security gaps.
Expected outcome:
A prioritized review covering token storage, CSRF headers, cookie settings, refresh retries, route guards, and error handling.
Security Audit
SafeAll static findings were reviewed against SKILL.md. The command alerts are Markdown code fences, and the network, environment, sensitive, and reconnaissance alerts are non-executed authentication examples. No prompt injection, malicious intent, or credential exfiltration evidence was found.
Risk Factors
⚙️ External commands (27)
🌐 Network access (10)
🔑 Env variables (6)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cjharmath-web-auth/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cjharmath-web-auth?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cjharmath-web-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cjharmath-web-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cjharmath-web-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CJHarmath. (2026). web-auth security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cjharmath-web-auth/audits/7BibTeX citation
@techreport{cjharmath-cjharmath-web-auth-2026,
author = {CJHarmath},
title = {web-auth security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/cjharmath-web-auth/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-auth security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "CJHarmath"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cjharmath-web-auth/audits/7"
identifiers:
- type: other
value: "skillstore:cjharmath-web-auth:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Add Login To A React App
Create a login flow with cookie-backed sessions, current user loading, and logout behavior.
Configure OAuth In Next.js
Set up Google OAuth or NextAuth.js with provider callbacks and session access in components.
Harden Authentication UX
Add protected routes, token refresh, form validation, CSRF headers, and security response headers.
Try These Prompts
Use the web-auth skill to create a React auth context for login, logout, current user loading, and protected route checks.
Use the web-auth skill to design a cookie-based login, logout, and refresh flow for my React app and API.
Use the web-auth skill to add Google OAuth to a Next.js app with NextAuth.js, callbacks, and protected dashboard pages.
Use the web-auth skill to review my React authentication flow for token storage, CSRF handling, route protection, and refresh behavior.
Best Practices
- Prefer httpOnly secure cookies for long-lived session tokens when the backend supports them.
- Pair cookie authentication with CSRF protection and explicit credential handling in requests.
- Protect routes on both the client and server when the framework supports server checks.
Avoid
- Do not store long-lived access tokens in localStorage without accepting the XSS exposure.
- Do not trust a client route guard as the only authorization control.
- Do not expose OAuth client secrets in browser code or public environment variables.