Authentication and authorization patterns. Use when implementing login flows, JWT tokens, session management, password security, OAuth 2.1, Passkeys/WebAuthn, or role-based access control.
/plugin marketplace add yonatangross/skillforge-claude-plugin/plugin install skillforge-complete@skillforgeThis skill is limited to using the following tools:
checklists/auth-checklist.mdexamples/auth-implementations.mdreferences/oauth-2.1-passkeys.mdtemplates/auth-middleware-template.pyImplement secure authentication with OAuth 2.1, Passkeys, and modern security standards.
from argon2 import PasswordHasher
ph = PasswordHasher()
password_hash = ph.hash(password)
ph.verify(password_hash, password)
import jwt
payload = {
'user_id': user_id,
'type': 'access',
'exp': datetime.utcnow() + timedelta(minutes=15),
}
token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')
import hashlib, base64, secrets
code_verifier = secrets.token_urlsafe(64)
digest = hashlib.sha256(code_verifier.encode()).digest()
code_challenge = base64.urlsafe_b64encode(digest).rstrip(b'=').decode()
app.config['SESSION_COOKIE_SECURE'] = True # HTTPS only
app.config['SESSION_COOKIE_HTTPONLY'] = True # No JS access
app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
| Token Type | Expiry | Storage |
|---|---|---|
| Access | 15 min - 1 hour | Memory only |
| Refresh | 7-30 days | HTTPOnly cookie |
# ❌ NEVER store passwords in plaintext
user.password = request.form['password']
# ❌ NEVER use implicit OAuth grant
response_type=token # Deprecated in OAuth 2.1
# ❌ NEVER skip rate limiting on login
@app.route('/login') # No rate limit!
# ❌ NEVER reveal if email exists
return "Email not found" # Information disclosure
# ✅ ALWAYS use Argon2id or bcrypt
password_hash = ph.hash(password)
# ✅ ALWAYS use PKCE
code_challenge=challenge&code_challenge_method=S256
# ✅ ALWAYS rate limit auth endpoints
@limiter.limit("5 per minute")
# ✅ ALWAYS use generic error messages
return "Invalid credentials"
| Decision | Recommendation |
|---|---|
| Password hash | Argon2id > bcrypt |
| Access token expiry | 15 min - 1 hour |
| Refresh token expiry | 7-30 days with rotation |
| Session cookie | HTTPOnly, Secure, SameSite=Strict |
| Rate limit | 5 attempts per minute |
| MFA | Passkeys > TOTP > SMS |
| OAuth | 2.1 with PKCE (no implicit) |
| Resource | Description |
|---|---|
| references/oauth-2.1-passkeys.md | OAuth 2.1, PKCE, Passkeys/WebAuthn |
| examples/auth-implementations.md | Complete implementation examples |
| checklists/auth-checklist.md | Security checklist |
| templates/auth-middleware-template.py | Flask/FastAPI middleware |
owasp-top-10 - Security fundamentalsinput-validation - Data validationapi-design-framework - API securityKeywords: password, hashing, bcrypt, argon2, hash Solves:
Keywords: JWT, token, access token, claims, jsonwebtoken Solves:
Keywords: OAuth, PKCE, OAuth 2.1, authorization code, code verifier Solves:
Keywords: passkey, WebAuthn, FIDO2, passwordless, biometric Solves:
Keywords: session, cookie, session storage, logout, invalidate Solves:
Keywords: RBAC, role, permission, authorization, access control Solves:
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.