auth-hardening

When to Use

Review auth flows, login, tokens, RBAC — "is this auth secure?"

TESTING (3 patterns)

Auth integration: test DB → POST /login → 200 + Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax Token validation: expired JWT→401; alg=none→401; wrong aud→403 RBAC matrix: parametrize roles×endpoints → 200 allowed, 403 denied, no 500s

CHECKLIST (sev: pattern)

CRIT: JWT alg=none algorithm.*["']none["'] | Hardcoded secret secret\s*=\s*["'][^"']+["'] excl env | MD5/SHA1 password md5\|sha1 HIGH: No CSRF on POST | OAuth no PKCE auth_code w/o code_verifier | No HttpOnly httpOnly.*false | JWT no expiry expiresIn missing/>24h | Role after fetch | No refresh rotation MED: Session fixation (login doesn't regenerate ID)

OUTPUT

## Auth Hardening: {scope}
### Summary
- JWT:{N} OAuth:{N} RBAC:{N} CSRF:{N} Sessions:{N} Passwords:{N}
### Issues
# CRITICAL: {type} in {file:line}
- Pattern: `{found}` → Fix: `{fix}`

Rules

1. JWT alg FIRST. 2. Role checks BEFORE data. 3. CSRF on ALL state-changing. 4. bcrypt/argon2 ONLY. 5. "Remaining risk: NONE/LOW/MED/HIGH (why)"

Anti-Rationalization

Rationalization	Red Flag	Verification
"JWT HS256 default porque es fácil"	HS256 sin rotación/alg=none permitido	JWT alg FIRST + test alg=none→401, expiresIn check
"PKCE opcional"	OAuth auth_code sin code_verifier	CHECKLIST PKCE HIGH + grep code_verifier
"CSRF solo para cookies"	POST/PUT sin token CSRF	Rule 3 CSRF on ALL state-changing + grep csrf

Red Flags

• Doing work without checking output format → STOP, re-read skill
• Second occurrence of same rationalization → force RED zone

Verification

• Output matches skill ## Output contract + file:line citaton
• cross-ref-check.ps1 → SKILL.md OK

API REST Playbook

JWT: alg allowlist HS256/RS256/ES256 - REJECT none/alg-confusion/symmetric+pubkey | exp required server-clock skew<=60s | aud+iss match else 401 AuthZ: BOLA userA->/users/{B} 403/404 never 200 | bulk foreign ids per-item reject | BOPLA mass-assign strict allowlist (zod/joi/pydantic) | IDOR roles x endpoints no 500s JWT keys: jku/x5u REJECT unless explicit https allowlist (TLS verify, no user-controlled URL) | x5c/x5t: chain vs TRUST STORE + revocation - never self-declared | kid: server-side allowlist lookup only - no path/index traversal, no weak-key (alg-confusion) selection

changelog: odd/tasks/mejora-security.md (2026-09-18, slice 6) changelog: odd/tasks/mejora-security.md (2026-09-18, slice 1)

SPA Playbook (token storage / cookie-auth CSRF)

Token storage: httpOnly cookie=cookie-auth XSS-leak-proof (JS can't read) | sessionStorage=same-tab ephemeral only | localStorage NEVER for access/refresh tokens (any injected script reads it) Cookies: Secure+HttpOnly+SameSite=Lax (Strict for money) + Path=/ | CSRF: token header/double-submit on POST/PUT/DELETE when cookie-auth, fetch credentials:'include', logout=Max-Age 0

changelog: odd/tasks/mejora-security.md (2026-09-18, slice 2)

Refs

security-scanner · best-practices · quality-gate · code-review-agent · llm-security · container-security · infra-audit

Anti-Patterns (8)

Flag bcrypt weak · Skip JWT alg · Happy path only · Ignore refresh tokens · Client-side-only roles · Flag env vars hardcoded · Use alg: none for testing · Store JWT in localStorage

Reference

docs/skills/auth-hardening/reference.md