Auth Implementation Patterns

Authentication & Authorization Implementation Patterns

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

• Implementing user authentication systems

• Securing REST or GraphQL APIs

• Adding OAuth2/social login

• Implementing role-based access control (RBAC)

• Designing session management

• Migrating authentication systems

• Debugging auth issues

• Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

• Verifying identity (username/password, OAuth, biometrics)

• Issuing credentials (sessions, tokens)

• Managing login/logout

Authorization (AuthZ): What can you do?

• Permission checking

• Role-based access control (RBAC)

• Resource ownership validation

• Policy enforcement

2. Authentication Strategies

Session-Based:

• Server stores session state

• Session ID in cookie

• Traditional, simple, stateful

Token-Based (JWT):

• Stateless, self-contained

• Scales horizontally

• Can store claims

OAuth2/OpenID Connect:

• Delegate authentication

• Social login (Google, GitHub)

• Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

1. Never Store Plain Passwords: Always hash with bcrypt/argon2

2. Use HTTPS: Encrypt data in transit

3. Short-Lived Access Tokens: 15-30 minutes max

4. Secure Cookies: httpOnly, secure, sameSite flags

5. Validate All Input: Email format, password strength

6. Rate Limit Auth Endpoints: Prevent brute force attacks

7. Implement CSRF Protection: For session-based auth

8. Rotate Secrets Regularly: JWT secrets, session secrets

9. Log Security Events: Login attempts, failed auth

10. Use MFA When Possible: Extra security layer

Common Pitfalls

• Weak Passwords: Enforce strong password policies

• JWT in localStorage: Vulnerable to XSS, use httpOnly cookies

• No Token Expiration: Tokens should expire

• Client-Side Auth Checks Only: Always validate server-side

• Insecure Password Reset: Use secure tokens with expiration

• No Rate Limiting: Vulnerable to brute force

• Trusting Client Data: Always validate on server