Agent Skills
› aiming-lab/MetaClaw
› auth-and-authorization-patterns
auth-and-authorization-patterns
GitHub提供身份认证与授权最佳实践，涵盖密码哈希、JWT/OAuth2流程、RBAC/ABAC权限控制及会话安全管理。适用于实现登录、令牌签发、访问控制及安全合规场景。
Trigger Scenarios
实现用户登录或注册流程
配置JWT或OAuth2认证
设计基于角色的访问控制(RBAC)
处理会话管理与安全加固
Install
npx skills add aiming-lab/MetaClaw --skill auth-and-authorization-patterns -g -y
SKILL.md
Frontmatter
{
"name": "auth-and-authorization-patterns",
"category": "security",
"description": "Use this skill when implementing authentication (login, token issuance) or authorization (access control, permissions). Apply whenever the task involves login flows, JWT, OAuth2, session management, or RBAC."
}
Auth & Authorization Patterns
Authentication (who are you?):
- Use a battle-tested library — do not roll your own crypto.
- Hash passwords with bcrypt/argon2; never MD5/SHA1 for passwords.
- Use short-lived JWTs (15–60 min) with refresh tokens; store refresh tokens securely.
- Implement MFA for sensitive operations.
Authorization (what can you do?):
- Check authorization on every request, not just at login.
- Enforce RBAC or ABAC at the service layer, not the UI.
- Apply principle of least privilege: grant minimal permissions needed.
OAuth2 / OIDC:
- Use the Authorization Code flow with PKCE for user-facing apps.
- Validate
iss,aud,exp, andnonceclaims on every token.
Session management:
- Regenerate session ID after login (session fixation prevention).
- Set
HttpOnlyandSecureflags on session cookies.
Version History
- 922caf3 Current 2026-07-25 11:07
