Skip to content

add-authentication-system.md

Latest commit

 

History

History
78 lines (66 loc) · 3.42 KB

add-authentication-system.md

File metadata and controls

78 lines (66 loc) · 3.42 KB

Add Authentication System

Implement secure user authentication system

Instructions

  1. Authentication Strategy Analysis

    • Analyze application requirements and user types
    • Define authentication methods (password, OAuth, SSO, MFA)
    • Assess security requirements and compliance needs
    • Plan user management and role-based access control
    • Evaluate existing authentication infrastructure and integration points

  2. Authentication Method Selection

    • Choose appropriate authentication strategies:
      • Username/Password: Traditional credential-based authentication
      • OAuth 2.0/OpenID Connect: Third-party authentication (Google, GitHub, etc.)
      • SAML: Enterprise single sign-on integration
      • JWT: Stateless token-based authentication
      • Multi-Factor Authentication: SMS, TOTP, hardware tokens
      • Passwordless: Magic links, WebAuthn, biometric authentication

  3. User Management System

    • Set up user registration and account creation workflows
    • Configure user profile management and data storage
    • Implement password policies and security requirements
    • Set up account verification and email confirmation
    • Configure user deactivation and account deletion procedures

  4. Authentication Implementation

    • Implement secure password hashing (bcrypt, Argon2, scrypt)
    • Set up session management and token generation
    • Configure secure cookie handling and CSRF protection
    • Implement authentication middleware and route protection
    • Set up authentication state management (client-side)

  5. Authorization and Access Control

    • Implement role-based access control (RBAC) system
    • Set up permission-based authorization
    • Configure resource-level access controls
    • Implement dynamic authorization and policy engines
    • Set up API endpoint protection and authorization

  6. Multi-Factor Authentication (MFA)

    • Configure TOTP-based authenticator app support
    • Set up SMS-based authentication codes
    • Implement backup codes and recovery mechanisms
    • Configure hardware token support (FIDO2/WebAuthn)
    • Set up MFA enforcement policies and user experience

  7. OAuth and Third-Party Integration

    • Configure OAuth providers (Google, GitHub, Facebook, etc.)
    • Set up OpenID Connect for identity federation
    • Implement social login and account linking
    • Configure enterprise SSO integration (SAML, LDAP)
    • Set up API key management for external integrations

  8. Security Implementation

    • Configure rate limiting and brute force protection
    • Set up account lockout and security monitoring
    • Implement security headers and session security
    • Configure audit logging and security event tracking
    • Set up vulnerability scanning and security testing

  9. User Experience and Frontend Integration

    • Create responsive authentication UI components
    • Implement client-side authentication state management
    • Set up protected route handling and redirects
    • Configure authentication error handling and user feedback
    • Implement remember me and persistent login features

  10. Testing and Maintenance

    • Set up comprehensive authentication testing
    • Configure security testing and penetration testing
    • Create authentication monitoring and alerting
    • Set up compliance reporting and audit trails
    • Train team on authentication security best practices
    • Create incident response procedures for security events