security-authlisted
Install: claude install-skill murtazatouqeer/f5-framework-claude
# Security Auth Skill
Authentication and authorization patterns for secure applications.
## Quick Reference
### Authentication Methods
| Method | Use Case | Security Level |
|--------|----------|----------------|
| JWT + Refresh | SPAs, Mobile apps | High |
| Session cookies | Traditional web apps | High |
| OAuth2/OIDC | Social login, SSO | High |
| API Keys | Service-to-service | Medium |
| MFA | High-security apps | Very High |
### Authorization Patterns
| Pattern | Use Case | Complexity |
|---------|----------|------------|
| RBAC | Most applications | Low-Medium |
| ABAC | Fine-grained control | High |
| ReBAC | Relationship-based | Medium |
| Permission Matrix | Admin panels | Low |
## JWT Token Service
```typescript
export class TokenService {
private readonly accessExpiry = '15m'; // Short-lived
private readonly refreshExpiry = '7d'; // Rotate on use
generateTokenPair(user: User): TokenPair {
const accessToken = jwt.sign(
{ sub: user.id, type: 'access' },
this.accessSecret,
{ expiresIn: this.accessExpiry }
);
const refreshToken = jwt.sign(
{ sub: user.id, type: 'refresh' },
this.refreshSecret,
{ expiresIn: this.refreshExpiry }
);
return { accessToken, refreshToken };
}
}
```
## Password Hashing
```typescript
import bcrypt from 'bcrypt';
// Hash password (cost factor 12)
const hash = await bcrypt.hash(password, 12);
// Verify password
const isValid = await bcrypt.verify(password, hash);