Menu
Guidance for implementing and reviewing authentication code safely
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | Auth Hardening |
| description | Guidance for implementing and reviewing authentication code safely |
| category | security |
| keywords | ["auth","login","jwt","session","token","password","oauth"] |
| languages | ["python","typescript","javascript"] |
| framework | flask |
Always hash passwords with bcrypt or argon2 — never store plaintext or MD5. Validate JWTs on every protected route; check expiry, issuer, and signature. Rotate refresh tokens on use and invalidate old ones server-side. Set secure, httpOnly, sameSite=strict on session cookies. Rate-limit login endpoints and log failed attempts with IP and timestamp.
