security-authentication-and-sessions
Skill4 starsChanged 5 days agoMITView on GitHub
Assess and remediate authentication, sessions, identity tokens, mfa, federated sign-in and logout in frontend and associated web services. Use for login, session renewal or expiry, cookies, MFA, OAuth, OIDC, JWT, account recovery.
In this repository55 other files it gives its agents.
- design-balance-and-proportionSkill
- design-brand-and-art-directionSkill
- design-buildSkill
- design-color-theorySkill
- design-diagnoseSkill
- design-hierarchy-and-emphasisSkill
- design-imagery-and-textureSkill
- design-layout-and-gridSkill
- design-movement-and-flowSkill
- design-reviewSkill
- design-rhythm-and-patternSkill
- design-typographySkill
- design-unity-and-systemsSkill
- design-validateSkill
- security-api-files-and-realtimeSkill
- security-authorizationSkill
- security-browser-and-originSkill
- security-buildSkill
- security-configuration-and-secretsSkill
- security-crypto-and-dataSkill
- security-dependencies-and-buildSkill
- security-diagnoseSkill
- security-injection-and-validationSkill
- security-logging-and-failureSkill
- security-reviewSkill
- security-threat-model-and-designSkill
- security-validateSkill
- ux-accessibilitySkill
- ux-buildSkill
- ux-controls-and-inputsSkill
- ux-decisions-and-loadSkill
- ux-diagnoseSkill
- ux-feedback-and-performanceSkill
- ux-forms-and-errorsSkill
- ux-journeys-and-motivationSkill
- ux-navigation-and-structureSkill
- ux-onboarding-and-learningSkill
- ux-reviewSkill
- ux-trust-and-ethicsSkill
- ux-validateSkill
- ux-visual-hierarchySkill
- wcag-alternatives-and-mediaSkill
- wcag-assistive-tech-and-statusSkill
- wcag-buildSkill
- wcag-diagnoseSkill
- wcag-forms-and-error-preventionSkill
- wcag-keyboard-and-focusSkill
- wcag-language-and-predictabilitySkill
- wcag-navigation-and-discoverySkill
- wcag-pointer-and-touchSkill
- wcag-reviewSkill
- wcag-semantics-and-reading-orderSkill
- wcag-time-and-motionSkill
- wcag-validateSkill
- wcag-visual-and-responsiveSkill
The file
We split this skill into the rules it gives an agent
5 rules. About 0 are common, 3 are distinctive, and 2 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈3
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 17
Read references/playbook.md and the relevant ASVS chapter entries.
- Very specific: line 20
Test normal and denied paths with synthetic or approved fixtures, documenting exact methods and evidence.
- Distinctive: line 25
Do not confuse OAuth authorization tokens with authenticated browser sessions.
- Distinctive: line 26
Do not recommend inventing cryptographic protocols or custom token validation.
- Distinctive: line 28
No active probing of live systems, aggressive scanning, credential handling or cross-tenant requests without explicit authorization.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Authentication, session and federation risks
Scope
Use when the task concerns authentication, sessions, identity tokens, mfa, federated sign-in and logout. Common triggers include login, session renewal or expiry, cookies, MFA, OAuth, OIDC, JWT, account recovery. Do not classify unrelated symptoms as this category or expand the authorized scope. A client-side implementation may not reveal server-side enforcement.
ASVS 5.0.0 chapters: V6, V7, V9, V10. For exact requirement wording and levels consult ../security-diagnose/references/asvs/5.0.0/index.json and the version-pinned official ASVS source. Do not treat the index as the full standard. The local reference is references/playbook.md.
Procedure
- Establish the user action, attacker/actor, sensitive asset, trust boundary, affected runtime, and actual observed evidence.
- Read
references/playbook.mdand the relevant ASVS chapter entries. Resolve baseline using../security-diagnose/references/standard-selection.md(explicit task > project policy > planning fallback). - Differentiate the underlying cause from superficial symptoms; select a specific applicable requirement only after checking the authoritative source text.
- Implement or recommend the smallest verified control with the project’s existing security architecture. Prefer server-side enforcement when the failure crosses the browser trust boundary.
- Test normal and denied paths with synthetic or approved fixtures, documenting exact methods and evidence. Record residual unknowns; route broad assessments to
security-review, implementation tosecurity-buildand retesting tosecurity-validate.
Failure discipline
- Front-end hiding of a sign-in button is not authentication.
- Do not confuse OAuth authorization tokens with authenticated browser sessions.
- Do not recommend inventing cryptographic protocols or custom token validation.
No active probing of live systems, aggressive scanning, credential handling or cross-tenant requests without explicit authorization. Never report security certification from this skill alone.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.