Validating Authentication Implementations

Overview

Validate authentication mechanisms across web applications, APIs, and backend services for security weaknesses, compliance gaps, and implementation flaws. This skill examines password hashing, JWT token handling, session management, OAuth flows, MFA implementation, and account security controls against OWASP and NIST standards.

Prerequisites

• Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
• Familiarity with the authentication framework in use (Passport.js, Spring Security, Django Auth, NextAuth, etc.)
• Standard shell utilities and Grep/Glob available for codebase scanning
• Reference: ${CLAUDE_SKILL_DIR}/references/README.md for OWASP authentication cheat sheet, NIST password guidelines, and JWT RFC specifications

Instructions

1. Identify all authentication entry points by scanning for login routes, token endpoints, session initialization, and OAuth callback handlers using Grep across route definitions and controller files.