From f5-core
Provides authentication and authorization patterns including JWT with refresh tokens, OAuth2/OIDC, RBAC/ABAC, session management, and MFA. Includes TypeScript/NestJS code examples.
How this skill is triggered — by the user, by Claude, or both
Slash command
/f5-core:security-authThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Authentication and authorization patterns for secure applications.
Authentication and authorization patterns for secure applications.
| Method | Use Case | Security Level |
|---|---|---|
| JWT + Refresh | SPAs, Mobile apps | High |
| Session cookies | Traditional web apps | High |
| OAuth2/OIDC | Social login, SSO | High |
| API Keys | Service-to-service | Medium |
| MFA | High-security apps | Very High |
| Pattern | Use Case | Complexity |
|---|---|---|
| RBAC | Most applications | Low-Medium |
| ABAC | Fine-grained control | High |
| ReBAC | Relationship-based | Medium |
| Permission Matrix | Admin panels | Low |
export class TokenService {
private readonly accessExpiry = '15m'; // Short-lived
private readonly refreshExpiry = '7d'; // Rotate on use
generateTokenPair(user: User): TokenPair {
const accessToken = jwt.sign(
{ sub: user.id, type: 'access' },
this.accessSecret,
{ expiresIn: this.accessExpiry }
);
const refreshToken = jwt.sign(
{ sub: user.id, type: 'refresh' },
this.refreshSecret,
{ expiresIn: this.refreshExpiry }
);
return { accessToken, refreshToken };
}
}
import bcrypt from 'bcrypt';
// Hash password (cost factor 12)
const hash = await bcrypt.hash(password, 12);
// Verify password
const isValid = await bcrypt.verify(password, hash);
@Injectable()
export class RolesGuard implements CanActivate {
constructor(private reflector: Reflector) {}
canActivate(context: ExecutionContext): boolean {
const requiredRoles = this.reflector.getAllAndOverride<Role[]>(
ROLES_KEY, [context.getHandler(), context.getClass()]
);
if (!requiredRoles) return true;
const { user } = context.switchToHttp().getRequest();
return requiredRoles.some(role => user.roles?.includes(role));
}
}
// Passport OAuth2 Strategy
passport.use(new OAuth2Strategy({
authorizationURL: 'https://provider.com/oauth2/authorize',
tokenURL: 'https://provider.com/oauth2/token',
clientID: process.env.CLIENT_ID,
clientSecret: process.env.CLIENT_SECRET,
callbackURL: '/auth/callback',
}, (accessToken, refreshToken, profile, done) => {
return done(null, profile);
}));
// Storing passwords in plain text
user.password = plainPassword; // NEVER DO THIS
// Missing rate limiting on auth
app.post('/login', loginHandler); // ADD RATE LIMITING
// Long-lived access tokens
{ expiresIn: '30d' } // TOO LONG - use 15m max
| Gate | Requirement |
|---|---|
| G2 | Auth requirements documented |
| G2.5 | Auth controls implemented |
| G3 | Auth tests passing (90%+ coverage) |
npx claudepluginhub fujigo-software/f5-framework-claude --plugin f5-coreImplements authentication and authorization patterns including JWT access/refresh tokens, OAuth2 with PKCE, RBAC middleware, and session management.
Implements auth patterns like JWT, OAuth2, sessions, and RBAC for securing APIs. Use for user auth, API protection, social login, or debugging security issues.
Implements authentication and authorization patterns: JWT, OAuth2, session management, RBAC. Helps secure APIs and debug auth issues.