authentication-authorization
JWT, OAuth2, SAML, session management, RBAC, ABAC, and MFA implementation
Profile →npx skills add cosmicstack-labs/mercury-agent-skills --skill authentication-authorization --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Authentication & Authorization Implement secure auth in your applications. ## Authentication Methods | Method | Use Case | Security Level | |--------|----------|---------------| | Session/Cookie | Server-rendered apps | High (HTTP-only, secure flags) | | JWT | APIs, SPAs | Medium (stateless, revocable with blacklist) | | OAuth2 | Third-party login | High (delegate to providers) | | SAML | Enterprise SSO | High (enterprise identity) | | WebAuthn | Passwordless | Very high (biometric, hardware keys) | ### JWT Best Practices - Short expiry (15 min access, 7 day refresh) - Store refresh tokens in HTTP-only cookies (not localStorage) - Use RS256 (asymmetric) not HS256 in microservices - Include minimal claims (sub, exp, iat, scope) - Always validate signature + expiry + audience ## Authorization Models ### RBAC (Role-Based) ```json { "roles": ["admin", "editor", "viewer"], "permissions": { "admin": ["read:*", "write:*", "delete:*"], "editor": ["read:*", "write:*"], "viewer": ["read:*"] } } ``` ### ABAC (Attribute-Based) Policy engine evaluates: user attributes + resource attributes + environment *"Allow access if user.department == resource.department AND user.clearance >= resource.cl
- Authentication Methods
- JWT Best Practices
- Authorization Models
- RBAC (Role-Based)
- ABAC (Attribute-Based)
- MFA Implementation
- Enforcement
- Session Management
What does the authentication-authorization skill do?
JWT, OAuth2, SAML, session management, RBAC, ABAC, and MFA implementation
How do I install it?
Run `npx skills add cosmicstack-labs/mercury-agent-skills --skill authentication-authorization --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From cosmicstack-labs/mercury-agent-skills, a repository with 364 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.