VanaraVANARAagentsSubscribe — $10/mo
freeskillv2.0.0✓ verified

secure-auth

Implement authentication securely — authentication vs authorization, password hashing (argon2id/bcrypt), sessions vs JWT (storage, expiry, refresh, revocation), MFA, OAuth2/OIDC flows, and defenses against credential stuffing, session fixation, and CSRF. Worked examples + a runnable password-policy check.

$npx vanara install secure-auth

Free & open source (Apache-2.0) — view the source on GitHub.

Overview

Authentication is the front door to your system, and it is the single control attackers probe hardest. The goal of this skill is not to teach you to invent a clever scheme — it is to help you assemble well-understood primitives correctly, because almost every real-world breach in this area comes from a broken assembly of good parts, not from cracked cryptography. Heavy detail lives in references/;

What it covers

Details

Tier
Free
Version
2.0.0
Depth
4 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
api-paginationImplement correct, fast API pagination — cursor vs offset trade-offs, opaque cursor encoding, stable sort keys, page-size limits, total-count costs, and consumer-side iteration that survives inserts, deletes, and retries. With runnable cursor checks.app-store-optimizationHow to optimize an app-store listing (ASO) for discovery and conversion — title, subtitle, keywords, screenshots, icon, ratings, and the metadata that drives installs. A deep reference with worked Apple and Google listings and a runnable listing linter.audit-loggingDesign tamper-evident audit logs that satisfy security and compliance — what to record (who/what/when/where/outcome), what to never log (secrets/PII), structured immutable events, hash-chaining for tamper-evidence, retention, and access control. A deep reference with runnable validation.background-jobsDesign background job systems that don't lose or double work — enqueue-after-commit, retry policies with jitter, idempotent handlers, visibility timeouts, priority lanes, scheduled and recurring jobs, worker scaling, and observability for async work. With a runnable retry-policy check.backup-and-recoveryDesign and operate a tested backup and disaster-recovery strategy — the 3-2-1 rule, RPO/RTO targets, full vs incremental vs differential, point-in-time recovery, encryption, offsite/immutable copies, retention, and the restore drills that prove a backup actually works.c4-diagrammingDocument software architecture with the C4 model (Context, Container, Component, Code) as text-based diagrams in version control. Covers the four abstraction levels, notation discipline, when to draw each level (and when to stop), supplementary diagrams, and Mermaid/Structurizr tooling.
← All skills