auth-pro
Authentication and authorization (professional)
Skill text is English; answer in the user’s preferred language when Cursor User Rules, project rules, or the conversation specify it (identifiers and specs stay in English).
Use standards and vendor docs as authority for protocol details: OAuth 2.0 (RFC 6749), OIDC Core, and JWT (RFC 7519); align operational expectations with OWASP cheat-sheet areas (authentication, session management, authorization, OAuth) and digital-identity lifecycle concepts at architecture level. This skill encodes method-selection discipline, least-privilege authorization design, identity/authenticator/session lifecycle boundaries, and token/session safety. Confirm trust boundaries, client types (web/mobile/machine), threat model, and compliance constraints before proposing a solution.
Boundary
auth-pro owns authn/authz method and policy architecture, identity and authenticator lifecycle (design), session management policy, token/session lifecycle, federation posture, recovery/break-glass patterns, observability categories, and which pattern fits which context. It does not own framework-specific APIs, vendor console clicks, deep pentest methodology alone, or raw database DDL — combine with security-pro, postgresql-pro, and stack skills as needed.
| Skill | When to combine with auth-pro |
|---|---|
security-pro |
Threat modeling, abuse scenarios, defense-in-depth controls |
nestjs-pro / nextjs-pro |
Guards/middleware/session wiring and framework APIs |
postgresql-pro |
RLS and data ownership constraints for authz enforcement |
testing-pro |
Auth flow tests, permission regression, token/session abuse tests |