---

name: auth-builder description: | Implements secure authentication for web applications. This skill should be used when users want to add login/signup, protect routes, or integrate auth providers into their applications.

Auth Builder

Implement secure authentication adapted to framework and requirements.

What This Skill Does

• Implements authentication flows (signup, login, logout, refresh)
• Configures session or token-based auth
• Protects routes with middleware
• Integrates OAuth providers (optional)

What This Skill Does NOT Do

• Authorization (role-based access control) - separate concern
• Identity management (user profiles, settings)
• Multi-factor authentication setup
• Security auditing

---

Before Implementation

---

Required Clarifications

---

Implementation Workflow

Copy1. User Model → 2. Password Handling → 3. Auth Routes → 4. Middleware → 5. Token Management

1. User Model

Store only what's needed for auth:

• Email (unique, indexed)
• Password hash (NEVER plaintext)
• Created/updated timestamps

2. Password Handling

See references/security-patterns.md.

Requirements:

• Use bcrypt/argon2 (NOT MD5/SHA1)
• Cost factor ≥ 10
• Never log passwords

3. Auth Routes

4. Middleware

Protect routes requiring authentication.

5. Token Management

JWT Strategy:

• Short-lived access token (15 min)
• Long-lived refresh token (7 days)
• Store refresh token securely (httpOnly cookie)

---

Security Checklist

• Passwords hashed with bcrypt/argon2
• Tokens have expiration
• Refresh tokens stored in httpOnly cookies
• CSRF protection if using cookies
• Rate limiting on auth endpoints
• No sensitive data in JWT payload
• Secure password reset flow

---

Reference Files