From security-compliance
Provides OAuth 2.0 and OpenID Connect implementation patterns including authorization code flow, PKCE, token management, security best practices, and checklists for auth with Google, GitHub providers.
npx claudepluginhub jpoutrin/product-forge --plugin security-complianceThis skill uses the workspace's default tool permissions.
This skill provides guidance for OAuth 2.0 and OpenID Connect implementations.
Implements OAuth 2.0/OpenID Connect flows (Authorization Code + PKCE, Client Credentials, Refresh) for web/SPA/service auth. Express.js examples; Flask/Spring refs.
Guides OAuth2 flow selection—Authorization Code + PKCE for user apps, Client Credentials for M2M, Device Code for browserless—by client type and environment to prevent credential exposure.
Configures secure OAuth 2.0 flows including Authorization Code with PKCE, Client Credentials, and Device Grant. Covers PKCE, token lifecycle, scopes, and OAuth 2.1 best practices.
Share bugs, ideas, or general feedback.
This skill provides guidance for OAuth 2.0 and OpenID Connect implementations.
1. User → App: Click "Login with Google"
2. App → Auth Server: Redirect with client_id, redirect_uri, scope
3. User → Auth Server: Authenticate and consent
4. Auth Server → App: Redirect with authorization code
5. App → Auth Server: Exchange code for tokens
6. Auth Server → App: Access token + refresh token
# Generate code verifier and challenge
code_verifier = secrets.token_urlsafe(32)
code_challenge = base64url(sha256(code_verifier))
# Include in authorization request
params = {
"code_challenge": code_challenge,
"code_challenge_method": "S256",
}
@dataclass
class TokenSet:
access_token: str
refresh_token: str
expires_at: datetime
token_type: str = "Bearer"
async def refresh_tokens(refresh_token: str) -> TokenSet:
# Exchange refresh token for new access token
pass
Extends OAuth 2.0 with identity:
# ID token contains user identity claims
claims = {
"sub": "user123", # Subject (unique user ID)
"email": "user@example.com",
"name": "John Doe",
"iat": 1234567890, # Issued at
"exp": 1234567890, # Expiration
}