Auth Implementation Patterns
Guides the agent through designing login, sessions, JWT, OAuth2 and role-based access control securely
- Repository
- wshobson/agents
- Stars
- 42,095
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent gets a structured playbook for authentication and authorization work: how to tell who a user is (login, sessions, tokens, OAuth2/social or enterprise SSO) and what they are allowed to do (roles and permissions). It nudges the agent toward established security practices such as hashing passwords, using HTTPS, short-lived tokens, secure cookies, CSRF protection, rate limiting and server-side checks, and warns about common mistakes like storing JWTs in localStorage. The skill itself contains guidance only; it points to a references/details.md file for longer worked examples.
Great for
- Developers adding login or user accounts to a web or mobile app
- Engineers securing REST or GraphQL APIs with tokens or sessions
- Teams reviewing or debugging an existing authentication flow for common weaknesses
Skip it if
- Replacing production auth without expert review: generated patterns are general guidance and may not match your threat model or compliance needs
- Non-developers looking for a finished, drop-in login system: the skill explains patterns rather than providing vetted code for your stack
Try asking
- “Design a JWT and refresh token flow for my Node.js API”
- “Add Google and GitHub social login to my Express app and check it for security issues”
- “Review my session cookie settings and CSRF protection for this login form”
- “Plan role-based access control for an admin dashboard with three user roles”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
auth-implementation-patterns.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip auth-implementation-patterns.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip auth-implementation-patterns.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent your stack and framework (for example Django, Express or Rails) so its advice matches your libraries.
- Ask for a threat review of existing code rather than only new designs, since the skill's pitfalls checklist is most useful against real code.
- Have a security specialist verify any auth code before it handles real user data or payments.
What's inside
- references/details.md
- SKILL.md
Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.