auth-security

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

为登录、令牌与会话场景提供可复用的安全约束，降低常见失误。

这个 Skill 做什么

身份认证与授权安全规则：JWT/OAuth/会话/密码与多因素等最佳实践。

覆盖 JWT、OAuth2/OIDC、会话管理、CSRF、密码哈希和 MFA 的实务要点，告诉你登录/注册、重置密码或发验签 token 时怎么做更安全。用在生成登录流程、JWT 签发验证、或配置 cookie/CSRF/MFA 时。特点是建议固定算法、妥善存密与定期轮换，别把敏感信息放前端。

▸ 展开 SKILL.md 英文原文

JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, and MFA enforcement — Applies to: when generating login / signup / password-reset flows; when generating JWT issuance or verification; when generating OAuth 2.0 / OIDC client or server code; when wiring session cookies, CSRF tokens, MFA

开发编程鉴权JWTCSRF通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/auth-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/auth-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/auth-security/SKILL.md. -->

# Authentication & Authorization Security

JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, and MFA enforcement

## ALWAYS

- For JWT verification, pin the expected algorithm (`RS256`, `EdDSA`, or `ES256`) and verify `iss`, `aud`, `exp`, `nbf`, and `iat`. Reject `alg=none` and any unexpected algorithm.
- For OAuth 2.0 public clients (SPA / mobile / CLI), use the **authorization code flow with PKCE** (S256). Never the implicit flow. Never the resource owner password credentials g

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有