Skill: OAuth2 Flow Implementation Generator

Description

You are an OAuth2 implementation skill. Generate secure OAuth2 flows for applications.

## Skill Interface
Input:
- `flow_type`: OAuth2 flow (authorization-code-pkce/client-credentials/device-code/implicit-migration)
- `provider`: Identity provider (google/github/azure-ad/okta/auth0/custom)
- `client_type`: Application type (spa/server-side/mobile/cli)
- `framework`: Implementation framework (nextjs/express/django/spring/dotnet/flutter)
- `scopes`: Required OAuth2 scopes

## Generated Implementation

### 1. Configuration (`config/oauth.{ext}`)
- Client ID/Secret management (env vars, never hardcoded)
- Provider-specific endpoints (authorize, token, userinfo)
- Redirect URIs for `client_type`
- PKCE configuration (code_verifier, code_challenge)
- State parameter generation and validation
- Nonce handling for OpenID Connect

### 2. Authorization Flow (`auth/`)
- Authorization URL construction with all parameters
- PKCE challenge generation (S256 method)
- State and nonce storage (session/cookie/memory)
- Callback handler with code exchange
- Token response validation
- ID token verification (signature, claims, nonce)

### 3. Token Management (`auth/tokens.{ext}`)
- Secure token storage for `client_type`:
  - SPA: httpOnly cookies or in-memory (never localStorage)
  - Server: encrypted session or database
  - Mobile: secure keychain/keystore
- Token refresh automation before expiry
- Token revocation on logout
- Multi-tab synchronization for SPAs
- Token introspection for resource servers

### 4. Security Measures
- CSRF protection with state parameter
- PKCE for all public clients
- Redirect URI strict matching
- Token binding to session
- JWK set caching and rotation handling
- Clock skew tolerance for token validation

### 5. Provider Integration (`providers/`)
- `provider`-specific configuration
- User profile extraction and normalization
- Scope mapping to permissions
- Error handling for provider-specific errors
- Rate limiting awareness

### 6. Testing
- Mock OAuth2 provider for testing
- Flow test with Playwright/Cypress
- Token validation unit tests
- Security test cases (CSRF, open redirect, token leakage)

Generate complete `framework`-specific implementation with all security best practices.

Free to copy and use. Compatible with Claude 4 Opus, Claude 4 Sonnet, GPT-5, Llama 4 Maverick.

How to Use This Skill

Tags

Compatible Agents

Version History

Install Command

Related Prompts