Auth Patterns Skill

Authentication (who are you?) and authorization (what can you do?) are where most security vulnerabilities live. This skill covers correct implementation — not just review.

When to Activate

• Implementing login / logout flows
• Choosing between JWT and server-side sessions
• Adding OAuth2 / social login (GitHub, Google, etc.)
• Implementing API key authentication (server-to-server)
• Adding role-based access control (RBAC)
• Implementing refresh token rotation
• Adding MFA (multi-factor authentication)
• Auditing an existing auth flow for security gaps or token leakage

Choosing the Right Auth Mechanism