---
name: auth-authz
description: "Applies “Auth you didn't invent” as a repeatable product-quality gate. Use during backend work when proven library, scoped queries, idor-tested — identity is not a place to be creative."
---

# Auth you didn't invent

Apply this skill during **Backend** work. It supports Node / API, Python, Any stack.

Proven library, scoped queries, IDOR-tested — identity is not a place to be creative.

## Instructions

Never hand-roll authentication: use a proven library or provider for sessions, hashing, and tokens (short-lived access tokens, httpOnly secure cookies, CSRF where cookies are used). Authorization is enforced server-side on every resource access: scope every query by the authenticated principal at the query level — fetching broadly and filtering in application code is a vulnerability, not a pattern. Before shipping any endpoint, run the IDOR test: substitute another user's id and expect 403/404. Secrets exist only in the environment or a secret manager, never in code, git history, or logs, and every secret has a rotation path. Log auth events (login, failed attempt, password reset, privilege change) with enough context to investigate and never enough to leak a credential.

## Detect the problem

- Hand-rolled session/JWT handling
- userId read from the request body
- A secret in the repo 'temporarily'

## Hold the gate

Do not declare this phase complete until every item passes:

- [ ] Sessions/tokens come from a proven library or provider — nothing hand-rolled
- [ ] Every query is scoped by the authenticated principal — no 'fetch then filter'
- [ ] IDOR-tested: swap another user's id into every endpoint, expect 403/404
- [ ] Secrets live in env/secret manager only; repo history is clean; rotation is possible
- [ ] Auth events (login, failure, reset, escalation) are logged without leaking credentials

## Verify the result

Swap another user's id into every endpoint (IDOR pass) — expect 403/404 everywhere.