Authentication & Security

Implement modern authentication, authorization, and API security across Python, Rust, Go, and TypeScript.

When to Use This Skill

Use this skill when:

Building user authentication systems (login, signup, SSO)
Implementing authorization (roles, permissions, access control)
Securing APIs (JWT validation, rate limiting)
Adding passwordless auth (Passkeys/WebAuthn)
Migrating from password-based to modern auth
Integrating enterprise SSO (SAML, OIDC)
Implementing fine-grained permissions (RBAC, ABAC, ReBAC)

OAuth 2.1 Mandatory Requirements (2025 Standard)

┌─────────────────────────────────────────────────────────────┐
│           OAuth 2.1 MANDATORY REQUIREMENTS                  │
│                   (RFC 9798 - 2025)                         │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ✅ REQUIRED (Breaking Changes from OAuth 2.0)             │
│  ├─ PKCE (Proof Key for Code Exchange) MANDATORY           │
│  │   └─ S256 method (SHA-256), minimum entropy 43 chars   │
│  ├─ Exact redirect URI matching                            │
│  │   └─ No wildcard matching, no substring matching       │
│  ├─ Authorization code flow ONLY for public clients       │
│  │   └─ All other flows require confidential client       │
│  └─ TLS 1.2+ required for all endpoints                   │
│                                                             │
│  ❌ REMOVED (No Longer Supported)                          │
│  ├─ Implicit grant (security vulnerabilities)             │
│  ├─ Resource Owner Password Credentials grant              │
│  │   └─ Use OAuth 2.0 Device Flow (RFC 8628) instead      │
│  └─ Bearer token in query parameters                       │
│      └─ Must use Authorization header or POST body        │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Critical: PKCE is now mandatory for ALL OAuth flows, not just public clients.

JWT Best Practices

Signing Algorithms (Priority Order)

EdDSA with Ed25519 (Recommended)
- Fastest performance
- Smallest signature size
- Modern cryptography
ES256 (ECDSA with P-256)
- Good performance
- Industry standard
- Wide compatibility
RS256 (RSA)
- Legacy compatibility
- Larger signatures
- Slower performance

NEVER allow alg: none or algorithm switching attacks.

Token Lifetimes (Concrete Values)

Access token: 5-15 minutes
Refresh token: 1-7 days with rotation
ID token: Same as access token (5-15 minutes)

Refresh token rotation: Each refresh generates new access AND refresh tokens, invalidating the old refresh token.

Token Storage

Access token: Memory only (never localStorage)
Refresh token: HTTP-only cookie + SameSite=Strict
CSRF token: Separate non-HTTP-only cookie
Never log tokens: Redact in application logs

JWT Claims (Required)

{
  "iss": "https://auth.example.com",
  "sub": "user-id-123",
  "aud": "api.example.com",
  "exp": 1234567890,
  "iat": 1234567890,
  "jti": "unique-token-id",
  "scope": "read:profile write:data"
}

Password Hashing with Argon2id

OWASP 2025 Parameters

Algorithm: Argon2id
Memory cost (m): 64 MB (65536 KiB)
Time cost (t): 3 iterations
Parallelism (p): 4 threads
Salt length: 16 bytes (128 bits)
Target hash time: 150-250ms

Implementation

For concrete implementations, see references/password-hashing.md.

Key Points:

Argon2id is hybrid: data-independent timing + memory-hard
Tune memory cost to achieve 150-250ms on YOUR hardware
Use timing-safe comparison for verification
Migrate from bcrypt gradually (verify with old, rehash with new)

Passkeys / WebAuthn

Passkeys provide phishing-resistant, passwordless authentication using FIDO2/WebAuthn.

When to Use Passkeys

User-facing applications prioritizing security
Reducing password-related support burden
Mobile-first applications (biometric auth)
Applications requiring MFA without SMS

Cross-Device Passkey Sync

iCloud Keychain: Apple ecosystem (iOS 16+, macOS 13+)
Google Password Manager: Android, Chrome
1Password, Bitwarden: Third-party password managers

For implementation guide, see references/passkeys-webauthn.md.

Authorization Models

┌─────────────────────────────────────────────────────────────┐
│                Authorization Model Selection                │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  Simple Roles (<20 roles)                                  │
│  └─ RBAC with Casbin (embedded, any language)              │
│      Example: Admin, User, Guest                           │
│                                                             │
│  Complex Attribute Rules                                    │
│  └─ ABAC with OPA or Cerbos                                │
│      Example: "Allow if user.clearance >= doc.level        │
│                AND user.dept == doc.dept"                   │
│                                                             │
│  Relationship-Based (Multi-Tenant, Collaborative)          │
│  └─ ReBAC with SpiceDB (Zanzibar model)                    │
│      Example: "Can edit if member of doc's workspace       │
│                AND workspace.plan includes feature"         │
│      Use cases: Notion-like, GitHub-like permissions       │
│                                                             │
│  Kubernetes / Infrastructure Policies                       │
│  └─ OPA (Gatekeeper for admission control)                 │
│      Example: Enforce pod security policies                │
│                                                             │
└─────────────────────────────────────────────────────────────┘

For detailed comparison, see references/authorization-patterns.md.

Library Selection by Language

TypeScript

Use Case	Library	Context7 ID	Trust	Notes
Auth Framework	Auth.js v5	`/websites/authjs_dev`	87.4	Multi-framework (Next, Svelte, Solid)
JWT	jose 5.x	-	-	EdDSA, ES256, RS256 support
Passkeys	@simplewebauthn/server 11.x	-	-	FIDO2 server
Validation	Zod 3.x	`/colinhacks/zod`	90.4	Schema validation
Policy Engine	Casbin.js 1.x	-	-	RBAC/ABAC embedded

Python

Use Case	Library	Notes
Auth Framework	Authlib 1.3+	OAuth/OIDC client + server
JWT	joserfc 1.x	Modern, maintained
Passkeys	py_webauthn 2.x	WebAuthn server
Password Hashing	argon2-cffi 24.x	OWASP parameters
Validation	Pydantic 2.x	FastAPI integration
Policy Engine	PyCasbin 1.x	RBAC/ABAC embedded

Rust

Use Case	Library	Notes
JWT	jsonwebtoken 10.x	EdDSA, ES256, RS256
OAuth Client	oauth2 5.x	OAuth 2.1 flows
Passkeys	webauthn-rs 0.5.x	WebAuthn + attestation
Password Hashing	argon2 0.5.x	Native Argon2id
Policy Engine	Casbin-RS 2.x	RBAC/ABAC embedded

Go

Use Case	Library	Notes
JWT	golang-jwt v5	Community-maintained
OAuth Client	go-oidc v3	OIDC client only
Passkeys	go-webauthn 0.11.x	Duo-maintained
Password Hashing	golang.org/x/crypto/argon2	Standard library
Policy Engine	Casbin v2	Original implementation

Managed Auth Services

Service	Best For	Key Features
Clerk	Rapid development, startups	Prebuilt UI, Next.js SDK
Auth0	Enterprise, established	25+ social providers, SSO
WorkOS AuthKit	B2B SaaS, enterprise SSO	SAML/SCIM, admin portal
Supabase Auth	Postgres users	Built on Postgres, RLS

For detailed comparison, see references/managed-auth-comparison.md.

Self-Hosted Solutions

Solution	Language	Use Case
Keycloak	Java	Enterprise, on-prem
Ory	Go	Cloud-native, microservices
Authentik	Python	Modern, developer-friendly

For setup guides, see references/self-hosted-auth.md.

API Security Best Practices

Rate Limiting

// Tiered rate limiting (per IP + per user)
const rateLimits = {
  anonymous: '10 requests/minute',
  authenticated: '100 requests/minute',
  premium: '1000 requests/minute',
}

Use sliding window algorithm (not fixed window) with Redis.

CORS Configuration

// Restrictive CORS (production)
const corsOptions = {
  origin: ['https://app.example.com'],
  credentials: true,
  maxAge: 86400, // 24 hours
  allowedHeaders: ['Content-Type', 'Authorization'],
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
}

// NEVER use origin: '*' with credentials: true

Security Headers

const securityHeaders = {
  'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
  'X-Frame-Options': 'DENY',
  'X-Content-Type-Options': 'nosniff',
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
  'Content-Security-Policy': "default-src 'self'; script-src 'self'",
}

For complete API security guide, see references/api-security.md.

Frontend Integration Patterns

Protected Routes (Next.js)

// middleware.ts
import { withAuth } from 'next-auth/middleware'

export default withAuth({
  callbacks: {
    authorized: ({ token, req }) => {
      if (req.nextUrl.pathname.startsWith('/dashboard')) {
        return !!token
      }
      if (req.nextUrl.pathname.startsWith('/admin')) {
        return token?.role === 'admin'
      }
      return true
    },
  },
})

export const config = {
  matcher: ['/dashboard/:path*', '/admin/:path*'],
}

Role-Based UI Rendering

import { useSession } from 'next-auth/react'

export function AdminPanel() {
  const { data: session } = useSession()

  if (session?.user?.role !== 'admin') {
    return null
  }

  return <div>Admin Controls</div>
}

Common Workflows

1. OAuth 2.1 Integration

Generate PKCE challenge
Redirect to authorization endpoint
Handle callback with authorization code
Exchange code for tokens (with code_verifier)
Store tokens securely
Implement refresh token rotation

See references/oauth21-guide.md for complete implementation.

2. JWT Implementation

Generate signing keys using scripts/generate_jwt_keys.py
Configure token lifetimes (5-15 min access, 1-7 day refresh)
Implement token validation middleware
Set up refresh token rotation
Configure token storage (memory for access, HTTP-only cookie for refresh)

See references/jwt-best-practices.md for detailed patterns.

3. Passkeys Setup

Register credential during signup/settings
Generate challenge for registration
Verify attestation
Store credential ID and public key
Implement authentication flow with assertion

See examples/passkeys-demo/ for runnable implementation.

4. Authorization Engine Setup

Choose engine (Casbin for simple RBAC, SpiceDB for ReBAC)
Define schema/policies
Implement check functions
Integrate with route handlers
Add audit logging

See references/authorization-patterns.md for detailed comparison.

Integration with Other Skills

Forms Skill

Login/register forms with validation
Error states for auth failures
Password strength indicators
Email validation

API Patterns Skill

JWT middleware integration
Error response formats (401, 403)
OpenAPI security schemas
CORS configuration

Dashboards Skill

Role-based widget visibility
User profile display
Permission-based data filtering
Audit trail visualization

Observability Skill

Auth event logging (login, logout, permission denied)
Failed login tracking
Token refresh monitoring
Security incident alerting

Scripts

Generate JWT Keys

python scripts/generate_jwt_keys.py --algorithm EdDSA

Generates EdDSA or ES256 key pairs for JWT signing.

Validate OAuth 2.1 Configuration

python scripts/validate_oauth_config.py --config oauth.json

Validates OAuth 2.1 compliance (PKCE enabled, exact redirect URIs, etc.).

Examples

Auth.js + Next.js

Complete implementation with OAuth providers, credentials, and session management.

Location: examples/authjs-nextjs/

Keycloak + FastAPI

Self-hosted Keycloak with FastAPI integration via OIDC.

Location: examples/keycloak-fastapi/

Passkeys Demo

Runnable passkeys implementation with @simplewebauthn.

Location: examples/passkeys-demo/

Reference Documentation

references/oauth21-guide.md - OAuth 2.1 implementation guide
references/jwt-best-practices.md - JWT generation, validation, storage
references/passkeys-webauthn.md - Passkeys/WebAuthn implementation
references/authorization-patterns.md - RBAC, ABAC, ReBAC comparison
references/password-hashing.md - Argon2id parameters, migration

securing-authentication