skills.rest
coreyone
coreyoneCOMMUNITY
Explore all skills by this author →
GitHub

auth-and-identity-rules

Implements OAuth 2.1 PKCE flows, JWT validation, and secure credential storage for applications.

1|Updated Jun 29, 2026
Search Tags:#security#authentication#oauth#jwt#session management#webauthn#pkce
One-click install
npx skills add https://github.com/coreyone/software-maestro --skill auth-and-identity-rules-coreyone
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-and-identity-rules
Source: https://github.com/coreyone/software-maestro/tree/main/security/auth-and-identity-rules
Command: npx skills add https://github.com/coreyone/software-maestro --skill auth-and-identity-rules-coreyone

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Building authentication and authorization correctly is error-prone: weak JWT validation, insecure token storage, and outdated OAuth flows expose applications to token theft, XSS, and CSRF attacks. This Skill guides the implementation of modern identity controls without forcing a stack migration. ## Core Features & Use Cases - OAuth 2.1 & PKCE Flows: Standardizes Authorization Code with PKCE for public and confidential clients, eliminating deprecated implicit grants. - JWT Verification: Enforces cryptographic signature checks with issuer, audience, and algorithm allowlist validation against JWKS endpoints. - Secure Credential Storage: Directs iOS tokens to Keychain and web sessions to HttpOnly/Secure/SameSite cookies via the BFF pattern, plus Passkey/WebAuthn support. - Use Case: When adding sign-in to a mobile app, use this Skill to design the Authorization Code with PKCE flow, store refresh tokens in the iOS Keychain, and verify JWTs correctly at the API layer. ## Quick Start Use the auth-and-identity-rules skill to review my JWT validation middleware and design a PKCE-based login flow for my app.

Frequently Asked Questions about auth-and-identity-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OAuth 2.1 PKCE for a mobile app?▼

Use the Authorization Code flow with PKCE: generate a random code_verifier, send its hash as code_challenge in the authorize request, and exchange the code with the raw verifier. Never embed a client secret in a public mobile client.

How to validate JWT tokens securely in an API?▼

Verify the signature cryptographically using the provider's JWKS public keys, reject alg:none, and enforce an allowed algorithm list. Also assert the iss, aud, exp, and nbf claims with a small clock-skew tolerance.

Where should I store auth tokens on iOS and web?▼

On iOS, store tokens in Keychain with ThisDeviceOnly accessibility attributes, never in UserDefaults. On web, use HttpOnly, Secure, SameSite cookies via a Backend-for-Frontend pattern instead of localStorage to prevent XSS and CSRF attacks.

Does this work with Auth0, Firebase Auth, or NextAuth?▼

Yes, the Skill detects your existing identity stack such as Auth0, Firebase Auth, NextAuth, or Clerk and applies the security principles to those tools. It explicitly does not force a migration to a different authentication library.

When should I not use this authentication skill?▼

Do not use it for visual styling of sign-in forms, telemetry logging, or general database indexing unrelated to security. Broader transport and network defenses are handled by a separate web security skill.

Related Skills

Explore More Software Engineering Skills→
blazefluzblazefluz

Security Engineer

Audit security, test penetration, and check compliance for the Rentable application.

Community
Advanced
marquesfelipmarquesfelip

authorization-models

Design and review RBAC/ABAC authorization models for multi-tenant systems.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-config-hardening

Audit HTTP security headers, TLS settings, and CSP policies across web assets.

Official
Advanced
Lobbi-DocsLobbi-Docs
18

authentication

Authenticate user credentials and authorize resource access with JWT, OAuth2, OIDC, and RBAC.

Official
Advanced