auth-skill

leenBaksh's avatarfrom leenBaksh

Implement authentication systems with signup, signin, password security, JWT tokens, and Better Auth integration. Use for web application authentication.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 9, 2026
[Code Generation]

When & Why to Use This Skill

This Claude skill facilitates the end-to-end implementation of secure authentication systems for web applications. It covers essential features such as user registration, JWT-based session management, and Better Auth integration for social logins. Designed with security-first principles, it provides ready-to-use patterns for password hashing, token rotation, and multi-factor authentication, significantly reducing development time while ensuring robust protection against common vulnerabilities.

Use Cases

  • Case 1: Rapidly bootstrapping a production-ready user management system with secure signup and signin flows for a new web application.
  • Case 2: Implementing stateless authentication for RESTful APIs using JWT tokens and secure refresh mechanisms to support mobile and web clients.
  • Case 3: Integrating social login providers like Google and GitHub into existing projects using Better Auth for a seamless user onboarding experience.
  • Case 4: Enhancing application security by implementing industry-standard practices such as bcrypt password hashing, rate limiting, and secure HTTP-only cookie management.
nameauth-skill
descriptionImplement authentication systems with signup, signin, password security, JWT tokens, and Better Auth integration. Use for web application authentication.

Authentication System Implementation

Instructions

1. Core Authentication Flow

  • Secure user registration with validation
  • Protected login with session management
  • Password hashing with bcrypt/Argon2
  • JWT token generation and verification

2. Security Implementation

  • Password hashing (salt + pepper)
  • JWT token refresh mechanism
  • Rate limiting on auth endpoints
  • CORS configuration for APIs

3. Better Auth Integration

  • OAuth provider configuration
  • Social login setup (Google, GitHub, etc.)
  • Session management with Redis
  • Multi-factor authentication

Best Practices

  • Never store plain-text passwords
  • Use HTTPS in production
  • Set secure HTTP-only cookies for tokens
  • Implement proper error handling (don't reveal sensitive info)
  • Validate all user input server-side
  • Use environment variables for secrets
  • Regular token rotation and expiration

Example Structure

JWT Authentication Middleware

// middleware/auth.js
const jwt = require('jsonwebtoken');

const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) return res.sendStatus(401);
  
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
};