authentication-patterns
Design and implement secure authentication flows (sessions, tokens, OAuth/OIDC, passwordless, MFA). Use when adding login, signup, token handling, session management, or integrating identity providers.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- authentication-patterns
- description
- Design and implement secure authentication flows (sessions, tokens, OAuth/OIDC, passwordless, MFA). Use when adding login, signup, token handling, session management, or integrating identity providers.
03 SKILL.md 正文
Authentication Patterns
Overview
Authentication establishes identity. Mistakes here have high impact. Prefer proven patterns and well-maintained libraries over custom cryptography.
When to Use
- Implementing or reviewing login / signup
- Choosing between sessions, JWTs, or opaque tokens
- Integrating OAuth 2.0 / OpenID Connect
- Adding MFA or passwordless options
Key Considerations
- Prefer standard protocols and battle-tested libraries
- Store passwords only as strong hashes (or avoid passwords entirely)
- Protect tokens and cookies (HttpOnly, Secure, SameSite, short lifetimes where appropriate)
- Plan for logout, token revocation, and session invalidation
- Consider MFA for sensitive actions or high-risk accounts
- Be explicit about what “authenticated” means in distributed systems
Common Pitfalls
- Rolling your own crypto or session management
- Long-lived tokens without revocation strategy
- Mixing authentication and authorization concerns
- Leaking information in error messages (e.g., “user not found” vs “invalid credentials”)
Verification
- Auth flows are tested for common attack cases (credential stuffing resistance, token leakage, etc.)
- Secrets and tokens are handled safely
- Logout and revocation behave as expected
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.