# Auth Implementation Patterns

> Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Source: https://skillsagentes.com/skills/wshobson/agents/auth-implementation-patterns
Repository: https://github.com/wshobson/agents
Author: wshobson
License: MIT
Updated: hace 2 meses
Context cost: 58 tok installed, 669 tok once triggered, 4.1k tok with every bundled file
Bundle: 2 files, 16 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add wshobson/agents --skill auth-implementation-patterns --agent claude-code
```

## What it does

- Ofrece patrones para implementar autenticación (JWT, sesiones, OAuth2/OIDC) y autorización (RBAC)
- Da buenas prácticas de seguridad: hashing de contraseñas, HTTPS, tokens de vida corta, cookies seguras
- Enumera errores comunes a evitar como JWT en localStorage o falta de rate limiting
- Remite a `references/details.md` para patrones detallados y ejemplos completos

## Use it when

- Implementar sistemas de autenticación de usuarios
- Asegurar APIs REST o GraphQL
- Añadir OAuth2/login social
- Implementar RBAC, gestión de sesiones, SSO o multi-tenancy

## What triggers it

- "Ayúdame a implementar autenticación JWT en mi API"
- "Quiero añadir login con Google usando OAuth2"
- "Necesito diseñar un sistema RBAC para mi app"
- "Estoy depurando un problema de sesiones en mi backend"

## Files

- SKILL.md — 3 KB
- references/details.md — 13 KB

## SKILL.md

Reproduced verbatim from wshobson/agents under MIT. This section is the upstream document and is in English.

# Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

## When to Use This Skill

- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login
- Implementing role-based access control (RBAC)
- Designing session management
- Migrating authentication systems
- Debugging auth issues
- Implementing SSO or multi-tenancy

## Core Concepts

### 1. Authentication vs Authorization

**Authentication (AuthN)**: Who are you?

- Verifying identity (username/password, OAuth, biometrics)
- Issuing credentials (sessions, tokens)
- Managing login/logout

**Authorization (AuthZ)**: What can you do?

- Permission checking
- Role-based access control (RBAC)
- Resource ownership validation
- Policy enforcement

### 2. Authentication Strategies

**Session-Based:**

- Server stores session state
- Session ID in cookie
- Traditional, simple, stateful

**Token-Based (JWT):**

- Stateless, self-contained
- Scales horizontally
- Can store claims

**OAuth2/OpenID Connect:**

- Delegate authentication
- Social login (Google, GitHub)
- Enterprise SSO

## Detailed patterns and worked examples

Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.

## Best Practices

1. **Never Store Plain Passwords**: Always hash with bcrypt/argon2
2. **Use HTTPS**: Encrypt data in transit
3. **Short-Lived Access Tokens**: 15-30 minutes max
4. **Secure Cookies**: httpOnly, secure, sameSite flags
5. **Validate All Input**: Email format, password strength
6. **Rate Limit Auth Endpoints**: Prevent brute force attacks
7. **Implement CSRF Protection**: For session-based auth
8. **Rotate Secrets Regularly**: JWT secrets, session secrets
9. **Log Security Events**: Login attempts, failed auth
10. **Use MFA When Possible**: Extra security layer

## Common Pitfalls

- **Weak Passwords**: Enforce strong password policies
- **JWT in localStorage**: Vulnerable to XSS, use httpOnly cookies
- **No Token Expiration**: Tokens should expire
- **Client-Side Auth Checks Only**: Always validate server-side
- **Insecure Password Reset**: Use secure tokens with expiration
- **No Rate Limiting**: Vulnerable to brute force
- **Trusting Client Data**: Always validate on server

---

Skills Agentes — https://skillsagentes.com/skills/wshobson/agents/auth-implementation-patterns