Skill
Auth Implementation Patterns
Chooses between sessions, JWT and OAuth2 before any login page exists.
Install
/plugin marketplace add wshobson/agents; /plugin install developer-essentials
Triggers on
When a login system is being built, an API secured, or social login and SSO added.
- Author
- wshobson
- License
- MIT
Repositoryhttps://github.com/wshobson/agents
Authentication and authorization are kept apart on purpose: one answers who the caller is, the other what that caller may touch, and mixing them is where most access-control bugs start. The skill walks through server-side sessions, stateless tokens and OAuth2 or OpenID Connect with the trade-offs that actually decide the choice — revocation, horizontal scaling, and who owns the identity. Role-based access control, resource ownership checks and multi-tenant separation are covered on the authorization side.
Comments(0)
Sign in to comment