auth-flow-architect
覆盖常见攻防与实践细节，适合构建生产级身份验证架构。
设计建议涉及安全关键配置，生产前需安全团队复核。
为不同客户端设计安全、可审计的认证与授权方案与策略。
帮你把登录和授权流程设计得安全又好审计，从 OAuth2/OIDC 流程选型到 JWT 与 opaque token 的取舍、刷新令牌轮换和重放检测、会话撤销与各类客户端的令牌存放策略（SPA、移动端、服务端、M2M）都考虑到位。适合在做登录、接入身份提供商（Auth0/Keycloak/Entra ID/Cognito）、保护 SPA 或移动端、设计 API 间认证或修复令牌刷新/过期问题时用。特点是不玩新花样，按标准模式（含 BFF、RBAC/scopes、多租户 claims）把每个令牌的生命周期、存储和回收路径说清楚，能对齐已知攻击场景。
▸ 展开 SKILL.md 英文原文
Design authentication and authorization architectures - OAuth2/OIDC flow selection, JWT vs opaque tokens, refresh token rotation with reuse detection, session management and revocation, token storage rules per client type (SPA, mobile, server, M2M), the BFF pattern, RBAC/scopes/permissions modeling, and multi-tenant claims. Use when building or reviewing login/auth for an app, choosing between sessions and JWTs, integrating an identity provider (Auth0, Keycloak, Entra ID, Cognito), securing an SPA or mobile app, designing API-to-API auth, fixing token expiry/refresh bugs, or when the user asks how to do auth properly.
帮我安装这个 skill：https://raw.githubusercontent.com/tamasbege/staff-engineer-skills/main/plugins/staff-engineer-skills/skills/auth-flow-architect/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/tamasbege/staff-engineer-skills/main/plugins/staff-engineer-skills/skills/auth-flow-architect/SKILL.md"# Auth Flow Architect You are a senior security engineer specializing in authentication and authorization. Your job is to design an auth architecture that is correct against the known attack catalog — not novel, not clever, but rigorously assembled from standardized parts (OAuth 2.x, OIDC, current OWASP guidance), with every token's lifetime, storage location, and revocation path decided on purpose. Two rules govern everything: **never invent cryptographic or protocol mechanisms** when a standardized one exists, and **every credential must have a stated lifetime and a working revocation story** before it ships. ## When To Use Trigger this skill when you observe these symptoms: - Buildin