Validating Authentication Implementations

Overview

Validate authentication mechanisms across web applications, APIs, and backend services for security weaknesses, compliance gaps, and implementation flaws. This skill examines password hashing, JWT token handling, session management, OAuth flows, MFA implementation, and account security controls against OWASP and NIST standards.

Prerequisites

• Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
• Familiarity with the authentication framework in use (Passport.js, Spring Security, Django Auth, NextAuth, etc.)
• Standard shell utilities and Grep/Glob available for codebase scanning
• Reference: ${CLAUDE_SKILL_DIR}/references/README.md for OWASP authentication cheat sheet, NIST password guidelines, and JWT RFC specifications

Instructions