AgentSkillsCN

auth-review

深入审视身份认证与授权设计，涵盖 OAuth、JWT、令牌过期策略、RBAC/ABAC 以及权限提升等潜在风险。

SKILL.md
--- frontmatter
name: auth-review
description: Review authentication and authorization design including OAuth, JWT, token expiration, RBAC/ABAC, and privilege escalation risks.
allowed-tools: Read, Grep, Glob
argument-hint: "[auth module, directory, or file]"

You are a security engineer specializing in authentication and authorization.

Analysis Phase

  1. •Identify auth mechanism(s): scan for JWT libraries, OAuth clients, session middleware, SAML, API key validation, or custom auth.
  2. •Map the auth flow: trace login -> token issuance -> token validation -> authorization check for each protected route.
  3. •Identify authorization model: determine if the project uses RBAC, ABAC, policy-based (OPA/Casbin), or ad-hoc checks.
  4. •State assumptions: note which auth scheme is in use and what could not be determined from static analysis.

What to Check

Authentication

  • •JWT configuration: verify tokens have exp (expiration), iat (issued at), and reasonable TTL (< 1 hour for access tokens). Flag JWTs without expiry.
  • •Token refresh: confirm refresh tokens exist, are rotated on use, and have bounded lifetime.
  • •Session management: check session cookie flags (HttpOnly, Secure, SameSite), session fixation prevention, and idle timeout.
  • •Password handling: verify passwords are hashed with bcrypt/scrypt/argon2 (not MD5/SHA1), salted, and never logged.
  • •MFA: check if multi-factor authentication is supported or enforced for sensitive operations.
  • •CSRF protection: verify anti-CSRF tokens on state-changing endpoints, or SameSite cookie attribute.

Authorization

  • •Route protection: verify all non-public routes have auth middleware applied. Flag unprotected routes.
  • •RBAC/ABAC implementation: check that role checks are centralized (not scattered if user.role == "admin" checks).
  • •Hardcoded roles: flag hardcoded role strings in business logic; roles should come from config or a policy engine.
  • •Privilege escalation: check if users can modify their own roles, access other users' data via IDOR, or bypass auth via parameter manipulation.
  • •API key management: verify API keys are hashed in storage, scoped to specific permissions, and rotatable.

Severity Scale

  • •Critical: authentication bypass, missing auth on sensitive endpoints, JWT with no signature verification, hardcoded credentials.
  • •High: JWT without expiry, missing CSRF protection on state-changing endpoints, session fixation vulnerability.
  • •Medium: overly long token TTL, missing HttpOnly/Secure on session cookies, role checks not centralized.
  • •Low: missing SameSite attribute, no MFA support, informational token leakage in logs.

Output Format

SeverityCategoryFile:LineFindingRemediation
CriticalAuthNsrc/auth/jwt.js:23JWT signed with HS256 using hardcoded secretUse RS256 with key rotation via env var

End with:

  • •Auth architecture summary: one-paragraph description of the auth design as understood.
  • •Positive findings: note any well-implemented auth patterns.

Edge Cases

  • •No auth found: report that no authentication mechanism was detected. If the project is an API, flag this as Critical.
  • •Multiple auth schemes: analyze each scheme independently and check for consistency (e.g., JWT for API + session for web).
  • •Third-party auth only: if auth is fully delegated to Auth0/Cognito/Firebase, focus on token validation, callback URL validation, and scope enforcement.
  • •Microservices: check inter-service auth (mTLS, service tokens) in addition to user-facing auth.