auth-implementationlisted

# Auth Implementation Build authentication correctly the first time. Auth is the #1 place engineers introduce security holes — this skill gives language-agnostic patterns for sessions, tokens, OAuth, password hashing, and authorization. It builds what `security-review` later audits; align terminology with that skill. ## When to use - Implementing login, session management, token issuance, or password hashing - Adding OAuth2/OIDC (social login, SSO) or service-to-service authentication - Building RBAC/ABAC authorization checks (verify ownership, not just auth) - Choosing session-vs-token strategy and refresh-token rotation for a new app **Not for:** auditing existing auth for vulnerabilities (use `security-review`); designing the auth architecture at system level (use `architecture`); general implementation workflow (use `implement` — this skill supplies the auth-domain patterns, not the slice/TDD loop). ## Steps ### 1. Choose session vs token First-party web app with a server you control → **server-side sessions** (httpOnly cookie). API-first, microservices, or cross-domain → **JWT** (stateless). Hybrid (session cookie + access token for API calls) is common and fine. See the decision matrix in [references/token-patterns.md](references/token-patterns.md). Never store tokens in `localStorage`. ### 2. Hash passwords correctly bcrypt (cost ≥ 12), argon2id (preferred for new systems), or scrypt. These algorithms generate and embed a per-password salt internally — do not