Agent Skills
› aiming-lab/MetaClaw
› auth-and-authorization-patterns
auth-and-authorization-patterns
GitHub提供认证与授权最佳实践，涵盖登录流程、JWT/OAuth2实现、RBAC权限控制及会话管理安全规范，指导开发者使用成熟库并遵循最小权限原则。
Trigger Scenarios
实现用户登录或令牌发放
配置访问控制或权限校验
处理OAuth2或OIDC集成
管理会话安全策略
Install
npx skills add aiming-lab/MetaClaw --skill auth-and-authorization-patterns -g -y
SKILL.md
Frontmatter
{
"name": "auth-and-authorization-patterns",
"category": "security",
"description": "Use this skill when implementing authentication (login, token issuance) or authorization (access control, permissions). Apply whenever the task involves login flows, JWT, OAuth2, session management, or RBAC."
}
Auth & Authorization Patterns
Authentication (who are you?):
- Use a battle-tested library — do not roll your own crypto.
- Hash passwords with bcrypt/argon2; never MD5/SHA1 for passwords.
- Use short-lived JWTs (15–60 min) with refresh tokens; store refresh tokens securely.
- Implement MFA for sensitive operations.
Authorization (what can you do?):
- Check authorization on every request, not just at login.
- Enforce RBAC or ABAC at the service layer, not the UI.
- Apply principle of least privilege: grant minimal permissions needed.
OAuth2 / OIDC:
- Use the Authorization Code flow with PKCE for user-facing apps.
- Validate
iss,aud,exp, andnonceclaims on every token.
Session management:
- Regenerate session ID after login (session fixation prevention).
- Set
HttpOnlyandSecureflags on session cookies.
Version History
- 922caf3 Current 2026-07-25 11:07
