Authentication System Design

auth-system-design

Authentication system design and implementation guidance with Python examples using strict typing. Use when: (1) Designing authentication flows (signup, login, logout, refresh), (2) Selecting between session vs token-based auth, (3) Designing JWT structure and claims, (4) Implementing OAuth 2.0 f...

majiayu000/claude-skill-registry·0installs663starsSecurity

SKILL.md

Full skill instructions

Authentication System Design

Design secure and scalable authentication systems following industry best practices and security standards.

Quick Reference

Authentication Method Selection

Session-based: Traditional web apps, server-side control
JWT Token: SPA/mobile/microservices, stateless
OAuth 2.0: Third-party integration, standard protocols
OpenID Connect: Identity + authentication

JWT Claims Structure

Standard: iss, sub, aud, exp, nbf, iat, jti
Custom: userId, roles, permissions

Decision Workflow

1. Choose Authentication Method

Method	Best For	Key Considerations
Session-based	Traditional web apps	Server state required
JWT Token	SPA, mobile, microservices	Token revocation challenges
OAuth 2.0	Third-party integration	Complex setup
OpenID Connect	Identity verification	More complex than OAuth

2. Design Authentication Flows

Sign Up: Validate → Create → Verify → Login
Login: Validate → Generate tokens → Redirect
Logout: Invalidate → Clear → Redirect
Refresh: Check expiry → Use refresh token → Retry

3. JWT Structure & OAuth Selection

Use RS256 algorithm, short expiry (15-60 min)
Authorization Code flow for web apps, PKCE for public clients

4. Security Validation

Password hashing (bcrypt/Argon2)
Rate limiting, HTTPS, token expiration
Input validation, secure headers

Essential Patterns

Secure Password Handling

import bcrypt
def hash_password(password: str) -> str:
    salt = bcrypt.gensalt(rounds=12)
    return bcrypt.hashpw(password.encode(), salt).decode()

def verify_password(plain: str, hashed: str) -> bool:
    return bcrypt.checkpw(plain.encode(), hashed.encode())

JWT Token Operations

import jwt
from datetime import datetime, timedelta

def create_token(user_id: str, roles: list) -> str:
    payload = {
        "user_id": user_id,
        "roles": roles,
        "exp": (datetime.utcnow() + timedelta(minutes=15)).timestamp(),
        "iss": "https://your-app.com"
    }
    return jwt.encode(payload, key="secret", algorithm="RS256")

Resources

File	Purpose
auth-methods.md	Authentication method comparison
auth-flows.md	Flow diagrams and implementation
jwt-structure.md	JWT guidelines and examples
oauth-flows.md	OAuth 2.0 patterns
multi-service-auth.md	Multi-service strategies
password-reset.md	Secure reset implementation
rbac-system.md	Role-based access control
security-checklist.md	Security validation
integration-guide.md	Frontend/backend integration
jwt-template.yaml	JWT schema template

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/majiayu000/claude-skill-registry --skill auth-system-design

View on GitHub

skills/data/auth-system-design/SKILL.md

More Security skills

View all

Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K

View

Security

neon-postgres

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K

View

Security

firebase-auth-basics

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K

View

Security

firebase-security-rules-auditor

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K

View

Security

firebase-ai-logic-basics

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K

View

Security

better-auth-best-practices

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K

View

Security

vercel-cli-with-tokens

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K

View

Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K

View

Security

azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K

View