Implement Secure Auth Patterns
Authentication code often fails through weak token, session, or role checks. This skill gives practical patterns for secure access control design.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "auth-implementation-patterns" from https://skillstore.io/skills/wshobson-auth-implementation-patterns.md and its manifest at https://skillstore.io/api/skills/wshobson-auth-implementation-patterns/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "auth-implementation-patterns". I need secure login for an Express API used by a web app and mobile app.
Expected outcome:
A recommended JWT and refresh token design, including token lifetimes, storage guidance, revocation behavior, and middleware responsibilities.
Using "auth-implementation-patterns". I need admins, moderators, and regular users to access different endpoints.
Expected outcome:
A role and permission plan that separates authentication from authorization and adds server-side checks for each protected route.
Using "auth-implementation-patterns". I want to review my session cookie configuration before launch.
Expected outcome:
A checklist for httpOnly, secure, sameSite, expiration, Redis session storage, CSRF protection, and logout behavior.
The static shell, environment, sensitive file, and reconnaissance findings are false positives caused by Markdown fences and non-executed TypeScript examples. No prompt injection or malicious exfiltration intent was found. One content-level issue remains: the OAuth example places an access token in a URL query string.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/wshobson-auth-implementation-patterns/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/wshobson-auth-implementation-patterns?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/wshobson-auth-implementation-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-auth-implementation-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/wshobson-auth-implementation-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>wshobson. (2026). auth-implementation-patterns security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-auth-implementation-patterns/audits/8@techreport{wshobson-wshobson-auth-implementation-patterns-2026,
author = {wshobson},
title = {auth-implementation-patterns security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/wshobson-auth-implementation-patterns/audits/8},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "auth-implementation-patterns security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "wshobson"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/wshobson-auth-implementation-patterns/audits/8"
identifiers:
- type: other
value: "skillstore:wshobson-auth-implementation-patterns:audit:8"
description: "Skillstore immutable audit report identifier"
Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
wshobson-auth-implementation-patterns
2026-08-21
sickn33-auth-implementation-patterns
2026-08-21
Implement access tokens, refresh tokens, verification middleware, and logout behavior for an API.
Map roles, permissions, and resource ownership checks before exposing protected endpoints.
Compare an existing authentication flow against recommended token, session, cookie, and rate limit controls.
Help me choose between session authentication, JWT, and OAuth2 for my application. Ask about my stack, clients, deployment model, and security needs.
Use this skill to design a JWT login flow with short-lived access tokens, hashed refresh tokens, token revocation, and Express middleware.
Use this skill to define roles, permissions, middleware, and ownership checks for these routes. Include denial cases and tests to cover authorization failures.
Review my authentication and authorization design against this skill. Identify token, session, OAuth2, password, rate limiting, and RBAC risks with prioritized fixes.
Author
wshobsonLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
36e07d5e13068e5be64447e8f20b427cf2cbd21a
Maintenance freshness
7/18/2026
Usage
9 downloads · 287 views
File structure
📄 SKILL.md
Optimize Prompts With Proven Patterns
LLM prompts can fail through unclear instructions, weak examples, or missing evaluation. This skill provides templates, reasoning patterns, and optimization workflows for Claude, Codex, and Claude Code.
Manage Context-Driven Development
AI-assisted projects lose consistency when context lives in scattered notes. This skill provides a structured Conductor workflow for product, stack, workflow, and track artifacts.
Build Startup Financial Models
Startup teams need financial plans that connect revenue, hiring, expenses, runway, and fundraising assumptions. This skill guides Claude, Codex, and Claude Code through structured 3-5 year projections and scenario planning.
Write Blameless Incident Postmortems
Incident reviews often lose key facts or produce vague follow-up work. This skill guides Claude, Codex, and Claude Code through timelines, root cause analysis, meetings, and action items.
Transform Data Into Decision Stories
Raw metrics often fail to guide stakeholder decisions. This skill turns analysis into clear narratives, visual structures, and action plans.
Apply Python Design Patterns
Python projects often grow complex when responsibilities mix and abstractions appear too early. This skill guides focused refactors using KISS, SRP, layering, composition, and dependency injection.
Protect Next.js Auth Routes
by AayushBaniya2006
Authentication changes often fail when teams mix session APIs and route guards. This skill guides Claude, Codex, and Claude Code toward the project helpers for secure access control.
Plan API Security Testing
by sickn33
API reviews can miss authorization flaws, unsafe inputs, weak rate limits, and exposed errors. This skill organizes authorized REST and GraphQL testing into seven focused phases.
Review Code for Security Fundamentals
by DanielPodolsky
Security mistakes often appear in common areas like authentication, authorization, input handling, and data exposure. This skill gives Claude, Codex, and Claude Code a focused checklist for finding those risks during review.
Build CloudBase Node Auth Flows
by tencentcloudbase
Server-side CloudBase auth work can mix caller identity, user lookup, and custom login details. This skill guides Node.js agents through correct SDK methods and secure backend patterns.
Strengthen Security Engineering Decisions
by 89jobrien
Security work often spans architecture, identity, compliance, testing, and response planning. This skill gives Claude, Codex, and Claude Code structured security engineering guidance.
Choose Least-Privilege Azure RBAC Roles
by microsoft
Selecting an Azure role with excessive permissions increases security risk. This skill recommends minimal roles and prepares Azure CLI and Bicep assignments.