Authentication and authorization patterns for production applications. Use when: adding user login, signup, password reset, social login, role-based access, session management, JWT tokens, OAuth2, MFA, or any auth-related feature. Also use when reviewing auth security.
From cksnpx claudepluginhub cardinalconseils/claude-starter --plugin cksThis skill is limited to using the following tools:
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Domain expertise for implementing authentication and authorization in production applications. Covers pattern selection, common flows, password and session security, RBAC, social login, and provider recommendations by stack.
| Pattern | Best For | Trade-off |
|---|---|---|
| Session-based (cookies) | Server-rendered apps, same-domain | Requires server-side session store |
| JWT (stateless tokens) | APIs, mobile clients, microservices | Cannot revoke without blocklist |
| OAuth2 / OIDC | Third-party login, delegated auth | Complex setup, redirect flows |
| Magic links | Passwordless, low-friction signup | Depends on email delivery |
role column from day one, even if you only have one role now| Stack | Recommended Providers |
|---|---|
| Next.js | NextAuth.js, Clerk, Supabase Auth |
| React SPA + API | Auth0, Firebase Auth, Supabase Auth |
| Express/Node API | Passport.js, custom JWT, Clerk Backend |
| Full-stack Rails/Django | Built-in auth (Devise, django.contrib.auth) |
| Rationalization | Reality |
|---|---|
| "We'll add auth later" | Every endpoint is public until auth exists. "Later" means users see each other's data. |
| "Basic auth is fine for now" | Basic auth sends credentials on every request in a reversible encoding. Use sessions or tokens. |
| "We don't need roles yet" | Adding roles after launch requires migrating every user. Add the role field now. |
| "We'll just use localStorage for tokens" | localStorage is accessible to any XSS. Use httpOnly cookies for session tokens. |
| "Our app is internal, we don't need auth" | Internal apps get exposed. Auth is cheaper to add now than after a breach. |