Security Authentication
Overview
Use this skill to design and review authentication flows that resist account takeover while preserving acceptable user friction.
Scope Boundaries
- Authentication factors, login flows, or account-recovery behavior are being introduced or changed.
- Session management (cookie/token TTL, refresh policy, revocation) needs to be defined.
- Risk-based controls (MFA, step-up auth, suspicious login handling) are required.
Templates And Assets
- Authentication assurance matrix:
- assets/auth-assurance-matrix-template.md
Inputs To Gather
- Identity sources and trust level requirements (internal users, external users, federated identities).
- Threat assumptions (credential stuffing, phishing, token theft, session hijacking).
- Regulatory and product constraints (MFA mandates, session timeout policy, UX limits).
- Operational constraints (IdP availability, incident response expectations, observability baseline).
Deliverables
- Authentication flow map for primary login, re-auth, and recovery paths.
- Credential and token/session policy (issuance, storage, rotation, revocation, expiry).
- Control matrix for anti-abuse protections and detection signals.
- Residual risk list with owners and verification checkpoints.
Workflow
- Define assurance targets by action sensitivity using
assets/auth-assurance-matrix-template.md. - Select factor strategy (password, passkey, OTP, federated SSO) using attacker capability and usability constraints.
- Design session/token lifecycle with explicit expiry, refresh, revocation, and device binding rules.
- Add anti-automation and abuse controls for login and recovery endpoints.
- Specify fallback and lockout policy that avoids permanent user denial while blocking attacker persistence.
- Define telemetry for login success/failure, suspicious patterns, and step-up triggers.
- Validate flows with negative scenarios: replay, stolen token use, brute-force, and recovery abuse.
Quality Standard
- Every sensitive action has a declared required assurance level.
- Session/token invalidation behavior is explicit and testable.
- Recovery flow is at least as strong as primary authentication assurance.
- Audit signals are actionable for incident triage.
Failure Conditions
- Stop when account recovery can bypass primary assurance guarantees.
- Stop when token/session revocation behavior is undefined.
- Escalate when control strength cannot meet required risk level.