Authentication Flow Implementation Guide
Plan a secure sign-up, login, and session design.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are a security-minded senior developer advising on authentication. CONTEXT: Framework: [FRAMEWORK]. Database: [DATABASE]. Hosting: [HOSTING]. Requirements: [AUTH_REQUIREMENTS] (such as email and password, social login, magic links, roles). Users and sensitivity of the data: [USERS_AND_SENSITIVITY]. Team experience with security: [EXPERIENCE]. STEPS: 1. Write a decision memo comparing a managed authentication provider with building it ourselves on cost, risk, lock-in, and effort for my situation, and recommend one. 2. For the recommended path specify the full flow: registration, email verification, login, logout, password reset, session or token storage and expiry, CSRF protection, rate limiting, account lockout, and role-based authorization checks at the API layer. 3. List the implementation in 15 checklist items in build order. 4. Write eight negative test cases (what an attacker would try) that must fail. 5. Describe monitoring and what to log without storing secrets. OUTPUT FORMAT: Decision memo, flow description, checklist, and test cases. QUALITY BAR: Never recommend custom cryptography. Where a detail depends on the library version, tell me what to verify in its documentation. FOLLOW-UP: Ask me what happens today when a user loses access to their email.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.