Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
JWTs are encoded, not encrypted -- never put secrets in claims.
Always validate exp, iss, and aud on the server.
Enforce the expected algorithm to prevent alg: none or algorithm-switching attacks.
2. OAuth 2.0 Flows
Authorization Code Flow
For server-side apps. Client gets an authorization code via redirect and exchanges it for tokens server-side.
Redirect to GET /authorize?response_type=code&client_id=...&redirect_uri=...&scope=...&state=...
User authenticates and consents. Auth server redirects with ?code=...&state=...
Server exchanges the code: POST /token with grant_type=authorization_code, code, client_id, client_secret.
Authorization Code with PKCE
Required for public clients (SPAs, mobile) that cannot store a client secret.
Generate random code_verifier, derive code_challenge = BASE64URL(SHA256(code_verifier)).
Send code_challenge and code_challenge_method=S256 in the authorize request.
Send code_verifier in the token exchange. Server verifies the hash matches.
Client Credentials Flow
Machine-to-machine, no user. POST /token with grant_type=client_credentials, client_id, client_secret, scope. Returns an access token directly.
Device Authorization Flow
For input-constrained devices (smart TVs, CLI tools). Device gets a user code and verification URL, user authenticates on another device, device polls until complete.
HttpOnly -- not accessible to JavaScript. Secure -- HTTPS only. SameSite -- mitigates CSRF.
Session Stores
Store
Pros
Cons
Memory
Zero setup
Lost on restart, single-process
Redis
Fast, TTL support, clustered
Extra infrastructure
Database
Durable, queryable
Slower, needs cleanup job
Sliding vs. Absolute Expiration
Absolute -- expires at a fixed time. Sliding -- resets on each request. Combine both: slide 30 min with an 8-hour hard cap.
4. API Key Authentication
Generate with a CSPRNG (crypto.randomBytes(32), secrets.token_urlsafe(32)). Prefix for identification: sk_live_....
Store hashed (SHA-256) in the database. Show the raw key to the user once at creation.
Rotate by allowing a new key before revoking the old one; support an overlap period.
Best for server-to-server calls and usage tracking. Not suitable as sole auth for user-facing apps.
5. Basic Authentication
Authorization: Basic base64(username:password)
Acceptable: internal services behind VPN over TLS, development environments, webhook shared secrets.
Not acceptable: public-facing APIs, anything without HTTPS, anywhere token-based auth is feasible. Always pair with rate limiting.
6. Multi-Factor Authentication
TOTP (Time-Based One-Time Passwords)
Shared secret provisioned via QR code (otpauth:// URI). Client generates a 6-digit code every 30 seconds.
Server accepts current step +/- 1 for clock skew. Libraries: pyotp, speakeasy.
WebAuthn / Passkeys
Phishing-resistant: credential is bound to the origin by the browser.
Registration: server sends challenge, authenticator creates key pair, public key stored server-side.
Authentication: server sends challenge, authenticator signs it, server verifies.
Passkeys sync across devices via platform credential managers.
Guidance
Offer hashed backup codes. Store MFA secrets encrypted at rest.
Do not reveal MFA status during login -- check password first, then prompt for second factor.
7. Single Sign-On (SSO)
SAML 2.0
XML-based, common in enterprise. SP redirects to IdP, IdP posts a signed assertion to the SP's ACS URL.
Validate signature, audience, timestamps, and InResponseTo on every assertion.
OpenID Connect (OIDC)
Identity layer on OAuth 2.0. Authorization Code flow returns an id_token (JWT) with user claims (sub, email, name).
Discovery at /.well-known/openid-configuration. Verify id_token via JWKS; validate iss, aud, exp, nonce.
Choosing
OIDC: simpler, JSON-based, better for modern apps. SAML: entrenched in enterprise; support when customers require it.
8. Password Hashing
Algorithm
Notes
bcrypt
Widely supported, cost factor 12+ recommended
Argon2id
Password Hashing Competition winner, memory-hard
scrypt
Memory-hard, good where Argon2 is unavailable
Never use MD5, SHA-1, or SHA-256 alone -- these are fast hashes, trivially brute-forced. Never use unsalted hashes.
