Security Skill
Anti Reversing Techniques
Understand anti-reversing, obfuscation, and protection techniques encountered during software…
$15
Auth Implementation Patterns
Master authentication and authorization patterns including JWT, OAuth2, session management…
A complete reference of battle-tested authentication and authorization patterns: JWT with refresh tokens, Redis-backed sessions, OAuth2 social login and layered RBAC. It applies least-privilege, defense-in-depth and zero-trust thinking so you ship secure, scalable access control instead of homegrown auth with hidden holes.
$15 one-time
Add to a kit → Prices include 20% VAT. · Forged on real agency work · one-time, no lock-in
- Type Skill
- Category Security
- Delivery Email · instant
- License One-time
Inside the run · no black box
See the actual work before you buy it.
Auth systems fail at the edges: stale claims, weak lockouts, tokens that never die. The skill builds edge-first, from strategy choice through to revocation:
- Picks the authentication strategy first against the actual trade-offs: server side sessions (Redis store, httpOnly cookie), stateless JWT, or OAuth2/social login, instead of defaulting to whatever library is nearby.
- Implements the token layer with split lifetimes and split secrets: a 15 minute access token and a 7 day refresh token signed with separate secrets, refresh tokens hashed before they ever touch the database.
- Chains the middleware in order on every protected endpoint: authenticate (verify token, attach user), then requireRole or requirePermission (RBAC with role hierarchy), then requireOwnership where the resource has an owner; failures always fall to 401/403, never to partial access.
- Hardens the password path: bcrypt with 12 salt rounds, a Zod policy enforcing 12+ characters with mixed classes, and generic error messages so login responses never reveal whether the email or the password was wrong.
- Adds brute force protection where it matters: a Redis backed rate limiter capping login at 5 attempts per 15 minutes, plus a general API limiter, both before the auth logic runs.
- Wires the revocation lifecycle: refresh rotation on use, single token revoke on logout, revoke-all for logging out every device, and a fresh DB user fetch for critical operations instead of trusting stale JWT claims.
One power source. 6 lines out.
auth-implementation-patterns · core
core active · 6 lines
- ✓ implementing a new user
Implementing a new user authentication system from scratch
- ✓ securing rest or graphql
Securing REST or GraphQL APIs with token verification
- ✓ adding google or github
Adding Google or GitHub social login via OAuth2
- ✓ building role-based and
Building role-based and permission-based access control
- ✓ designing session manage…
Designing session management with secure cookies
- ✓ debugging or hardening an
Debugging or hardening an existing auth flow
Yours to keep.
Drag time forward. Watch what stays.
Forever
That's what owning means.
The rented stack
ai writing tool: subscription
expired · access lostanalytics suite: subscription
expired · access lostdesign platform: subscription
expired · access lost(nothing left)
Your forge
-
Ship access control that holds up because every layer verifies independently
license: perpetual -
Stop brute-force and credential-stuffing attacks with rate limiting and MFA-ready flows
license: perpetual -
Avoid the classic mistakes: JWT in localStorage, no expiry, client-side-only checks
license: perpetual -
Keep tokens and secrets protected so one leak doesn't collapse your whole auth stack
license: perpetual
subscriptions expire · deeds don't
Everything in the box.
Pick a piece up. Watch it work.
JWT generation, verification and a full refresh-token rotation service
6 parts · one working system · ships instantly by email
This wasn't forged for everyone.
- Not for you if you'd rather rent a tool than own one.
- Not for you if you want someone else to run your stack.
- Not for you if you're happy guessing.
Backend engineers building or hardening authentication who want secure, scalable patterns instead of risky DIY auth.
then this was forged for you.Works with
Universal by design: these run in any AI. Delivered in the open Agent Skills + MCP format (native in Claude); ChatGPT, Gemini, Cursor and Copilot adapt the same files their own way.
- Claude Native format
- ChatGPT Adapts via open standards
- Gemini Adapts via open standards
- Cursor Adapts via open standards
- Copilot Adapts via open standards
Catch what's on your mind.
the air is clear. nothing between you and the forge.
catch a spark: the forge will answer
-
Do I need Redis to use these patterns?
Only if you choose the server-side session pattern, since Redis backs that one for fast lookups and revocation. The JWT-with-refresh path doesn't require it, and the reference helps you pick between them based on your revocation needs.
-
Why implement auth myself instead of using a hosted provider?
If a managed provider fits, use it; these patterns are for when you're building or hardening auth yourself and want it done with least-privilege and defense-in-depth instead of improvised. The point is to avoid risky DIY, not to talk you out of buying.
-
Is this a library I install?
No, it's a reference of proven patterns you implement: JWT refresh flows, session handling, OAuth2 login, layered RBAC. It shows you the secure shape; wiring it into your codebase is yours.
-
How is it delivered?
By email right after purchase: ready to run, downloaded instantly, no setup wait.
-
One-time or subscription?
A one-time purchase; no subscription or hidden fees. VAT (20%) is included.
-
Can I get a refund?
As a digital product, it can’t be refunded once downloaded. That’s why we show exactly what’s inside and who it’s for, right here.