auth-implementation-patterns
Implement secure authentication patterns
You need clear guidance for secure authentication and authorization choices. This skill provides proven patterns and examples you can adapt quickly for JWT, OAuth2, and session management.
Download the skill ZIP
Upload in Claude
Go to Settings → Capabilities → Skills → Upload skill
Toggle on and start using
Test it
Using "auth-implementation-patterns". Design a secure JWT auth flow with refresh tokens for a REST API.
Expected outcome:
- Use short-lived access tokens and long-lived refresh tokens stored hashed in the database
- Verify refresh tokens on each rotation and revoke on logout
- Attach user claims to the request after verification
- Return 401 on expired or invalid tokens with clear error messages
Using "auth-implementation-patterns". How do I add Google OAuth2 login to my Express app?
Expected outcome:
- Configure Passport Google Strategy with client ID and secret from environment variables
- Set up callback URL to handle the OAuth redirect and generate JWT tokens
- Store or find user by Google ID, creating new user if not found
- Redirect to frontend with access token attached
Security Audit
SafePure documentation skill containing authentication code examples. All code is illustrative TypeScript demonstrating secure patterns (bcrypt with 12 rounds, JWT, proper cookie flags). No executable code, shell commands, network calls, or file system access beyond reading its own files. Static findings are false positives triggered by markdown code block backticks, environment variable references in examples, and security library mentions. The previous audit correctly identified this as safe.
Risk Factors
🌐 Network access (1)
⚙️ External commands (18)
🔑 Env variables (23)
Quality Score
What You Can Build
Secure an API
Choose and implement JWT or session auth with proper middleware and token handling.
Add social login
Integrate OAuth2 flows and redirect handling with clear examples.
Audit auth design
Check role and permission enforcement patterns against common pitfalls.
Try These Prompts
Recommend session or JWT auth for a small SaaS app. Include tradeoffs and a suggested default.
Provide a safe refresh token flow and storage guidance for a Node API.
Draft RBAC middleware and role hierarchy for users, moderators, and admins.
List concrete steps to secure login, including rate limiting and password policy.
Best Practices
- Keep access tokens short-lived and rotate refresh tokens with secure storage
- Enforce strong password policies with bcrypt or argon2 hashing
- Apply rate limits on authentication endpoints to prevent brute force attacks
Avoid
- Storing JWTs in localStorage without XSS protections
- Skipping token expiration or refresh token rotation
- Authorizing requests only on the client side without server validation