Auth Security Reviewer

What it does

The Auth Security Reviewer skill helps identify and correct common security vulnerabilities in authentication workflows, including session management, JSON Web Token (JWT) implementation, and Cross-Site Request Forgery (CSRF) protection. It provides examples of insecure configurations alongside secure alternatives, highlighting best practices for protecting user data and preventing unauthorized access. The skill focuses on code review to improve the overall security posture of applications handling authentication.

When to use it

• When implementing or reviewing authentication systems in a web application.
• To identify potential vulnerabilities related to session management and JWT usage.
• For ensuring proper CSRF protection is implemented across state-changing routes.
• During code audits to improve the security of existing authentication flows.

Key capabilities

• Session Security Review: Identifies insecure session configurations (e.g., weak secrets, unnecessary resave and saveUninitialized, missing HTTPS-only cookie flags) and provides secure alternatives.
• JWT Security Review: Highlights vulnerabilities in JWT implementations (e.g., hardcoded secrets, lack of expiration, storing tokens in localStorage) and suggests secure practices like using environment variables for secrets, setting short expiry times, and storing tokens in HTTPOnly cookies.
• CSRF Protection: Demonstrates the use of csurf middleware to protect against CSRF attacks and provides examples of how to integrate it into routes and provide CSRF tokens to the frontend.

Example prompts

• "Review this session configuration code for security vulnerabilities." (followed by pasting the insecure session configuration)
• "How can I securely implement JWT authentication in my application?"
• "Show me an example of how to protect a POST route from CSRF attacks."

Tips & gotchas

• The skill provides specific examples using libraries like jsonwebtoken and csurf. Ensure these dependencies are available in your environment.
• The provided code snippets are illustrative; adapt them to fit your application's specific needs and security policies.
• Pay close attention to the recommendations regarding storing secrets (using environment variables) and token expiry times for maximum security.