SKILL.md
Backend Security Authentication
When to use this skill
- User login/registration
- API authentication
- Session management
- Password security
Workflow
Instructions
Password Hashing
<?php
// Hash
$hash = password_hash($password, PASSWORD_DEFAULT);
// Verify
if (password_verify($inputPassword, $user->password)) {
// Correct
}
JWT Authentication
<?php
use Firebase\JWT\JWT;
class AuthService
{
public function generateToken(User $user): string
{
$payload = [
'iss' => 'myapp',
'sub' => $user->id,
'iat' => time(),
'exp' => time() + 3600
];
return JWT::encode($payload, env('JWT_SECRET'), 'HS256');
}
public function validateToken(string $token): ?object
{
try {
return JWT::decode($token, new Key(env('JWT_SECRET'), 'HS256'));
} catch (\Exception $e) {
return null;
}
}
}
Resources
- Never store plain passwords
- Use strong JWT secrets
- Implement token refresh
