Auth Implementation Patterns
Chooses between sessions, JWT and OAuth2 before any login page exists.
Install
/plugin marketplace add wshobson/agents; /plugin install developer-essentials
When a login system is being built, an API secured, or social login and SSO added.
- Author
- wshobson
- License
- MIT
Authentication and authorization are kept apart on purpose: one answers who the caller is, the other what that caller may touch, and mixing them is where most access-control bugs start. The skill walks through server-side sessions, stateless tokens and OAuth2 or OpenID Connect with the trade-offs that actually decide the choice — revocation, horizontal scaling, and who owns the identity. Role-based access control, resource ownership checks and multi-tenant separation are covered on the authorization side.
Similar skills
Duende Skills
SkillTwenty-four skills for OAuth, OpenID Connect and Duende IdentityServer work in ASP.NET Core.
Auth0 Agent Skills
SkillOne Auth0 skill that routes by framework and feature, then loads only the guides that apply.
secret-guard
SkillStops a write that carries a live credential.
Comments(0)
Sign in to comment