monolith-auth-and-sessions

name	monolith-auth-and-sessions
description	Use when implementing login/signup/logout, access control, and cookie-backed session logic in this Monolith app.

Monolith Auth and Sessions

Use this skill when

• Adding authentication or protecting routes.
• Reading/writing session values.

Core components

• Session package: app/session/session.go
• Auth middleware and controller (generated by auth scaffold)
• Config secret: config.SECRET_KEY

Bootstrap auth

Run: make generator authentication

Scaffold includes:

• User model
• session helpers
• auth middleware
• auth controller
• login/signup templates
• routes for /login, /signup, /logout

Session model

• Session store is Gorilla cookie store.
• Initialized once in session.InitSession().
• Standard keys include login flag and email.

Route protection pattern

Wrap handlers with login/admin middleware decorators. If user is anonymous, redirect to /login.

Security notes

• Always set SECRET_KEY in production.
• Never trust only client-side state for authorization decisions.
• Re-check privileges server-side in middleware.