{"id":"auth-implementation-patterns","name":"auth-implementation-patterns","summary":"JWT、OAuth2、セッション管理、RBACなどのマスター認証および認可パターンを導入し、安全でスケーラブルなアクセス制御システムを構築します。","body":"# Authentication & Authorization Implementation Patterns\n\nBuild secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.\n\n## When to Use This Skill\n\n- Implementing user authentication systems\n- Securing REST or GraphQL APIs\n- Adding OAuth2/social login\n- Implementing role-based access control (RBAC)\n- Designing session management\n- Migrating authentication systems\n- Debugging auth issues\n- Implementing SSO or multi-tenancy\n\n## Core Concepts\n\n### 1. Authentication vs Authorization\n\n**Authentication (AuthN)**: Who are you?\n\n- Verifying identity (username/password, OAuth, biometrics)\n- Issuing credentials (sessions, tokens)\n- Managing login/logout\n\n**Authorization (AuthZ)**: What can you do?\n\n- Permission checking\n- Role-based access control (RBAC)\n- Resource ownership validation\n- Policy enforcement\n\n### 2. Authentication Strategies\n\n**Session-Based:**\n\n- Server stores session state\n- Session ID in cookie\n- Traditional, simple, stateful\n\n**Token-Based (JWT):**\n\n- Stateless, self-contained\n- Scales horizontally\n- Can store claims\n\n**OAuth2/OpenID Connect:**\n\n- Delegate authentication\n- Social login (Google, GitHub)\n- Enterprise SSO\n\n## Detailed patterns and worked examples\n\nDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.\n\n## Best Practices\n\n1. **Never Store Plain Passwords**: Always hash with bcrypt/argon2\n2. **Use HTTPS**: Encrypt data in transit\n3. **Short-Lived Access Tokens**: 15-30 minutes max\n4. **Secure Cookies**: httpOnly, secure, sameSite flags\n5. **Validate All Input**: Email format, password strength\n6. **Rate Limit Auth Endpoints**: Prevent brute force attacks\n7. **Implement CSRF Protection**: For session-based auth\n8. **Rotate Secrets Regularly**: JWT secrets, session secrets\n9. **Log Security Events**: Login attempts, failed auth\n10. **Use MFA When Possible**: Extra security layer\n\n## Common Pitfalls\n\n- **Weak Passwords**: Enforce strong password policies\n- **JWT in localStorage**: Vulnerable to XSS, use httpOnly cookies\n- **No Token Expiration**: Tokens should expire\n- **Client-Side Auth Checks Only**: Always validate server-side\n- **Insecure Password Reset**: Use secure tokens with expiration\n- **No Rate Limiting**: Vulnerable to brute force\n- **Trusting Client Data**: Always validate on server","author":"@wshobson","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/wshobson/agents/tree/main/plugins/developer-essentials/skills/auth-implementation-patterns","license":"MIT","category":"security","lang":"en","tokens":541,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[{"path":"references/details.md","size":13674,"sha256":"cc556cbe7ac5987f40a332b5f77709aef9983dcc4ef29d10ebf1487f26eb7a64"}],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}