Auth Session Security Reviewer

The problem

Authentication bugs are high-stakes. A missing session regeneration call or a misconfigured JWT verification function is often the only thing standing between a secure app and a total account takeover.

What it does

• Identifies JWT vulnerabilities like alg: none exploits and symmetric/asymmetric algorithm confusion.
• Checks session management for fixation risks and improper invalidation during logout.
• Audits password reset flows for token predictability, single-use enforcement, and user enumeration.
• Reviews password storage implementations to ensure use of slow hashes like Argon2 or bcrypt with unique salts.
• Scrutinizes OAuth/OIDC relying party code for redirect_uri validation and state parameter integrity.

Why this beats prompting it yourself

Generic LLM reviews often provide vague best-practice advice. This skill focuses on demonstrable attack vectors, explaining exactly how a specific line of code enables an exploit so you can prioritize the fix. It follows a rigorous checklist derived from known failure patterns in JWT, OAuth, and session handling that generic prompts frequently overlook.

Use cases

• Reviewing a new JWT implementation to ensure tokens are securely signed, verified, and stored.
• Auditing a "forgot password" flow to prevent account enumeration and token hijacking.
• Checking login handlers for session fixation vulnerabilities before deployment.
• Verifying OAuth callback logic to ensure redirect URIs are properly locked down.

Known limitations

Cannot detect vulnerabilities in infrastructure-level auth (like WAF rules or VPC configs) if only application code is provided.