/add-authentication-system

Add Authentication System

Implement secure user authentication system

Instructions

1. **Authentication Strategy Analysis**

• Analyze application requirements and user types
• Define authentication methods (password, OAuth, SSO, MFA)
• Assess security requirements and compliance needs
• Plan user management and role-based access control
• Evaluate existing authentication infrastructure and integration points

2. **Authentication Method Selection**

• Choose appropriate authentication strategies:
• **Username/Password**: Traditional credential-based authentication
• **OAuth 2.0/OpenID Connect**: Third-party authentication (Google, GitHub, etc.)
• **SAML**: Enterprise single sign-on integration
• **JWT**: Stateless token-based authentication
• **Multi-Factor Authentication**: SMS, TOTP, hardware tokens
• **Passwordless**: Magic links, WebAuthn, biometric authentication

3. **User Management System**

• Set up user registration and account creation workflows
• Configure user profile management and data storage
• Implement password policies and security requirements
• Set up account verification and email confirmation
• Configure user deactivation and account deletion procedures

4. **Authentication Implementation**

• Implement secure password hashing (bcrypt, Argon2, scrypt)
• Set up session management and token generation
• Configure secure cookie handling and CSRF protection
• Implement authentication middleware and route protection
• Set up authentication state management (client-side)

5. **Authorization and Access Control**

• Implement role-based access control (RBAC) system
• Set up permission-based authorization
• Configure resource-level access controls
• Implement dynamic authorization and policy engines
• Set up API endpoint protection and authorization

6. **Multi-Factor Authentication (MFA)**

• Configure TOTP-based authenticator app support
• Set up SMS-based authentication codes
• Implement backup codes and recovery mechanisms
• Configure hardware token support (FIDO2/WebAuthn)
• Set up MFA enforcement policies and user experience

7. **OAuth and Third-Party Integration**

• Configure OAuth providers (Google, GitHub, Facebook, etc.)
• Set up OpenID Connect for identity federation
• Implement social login and account linking
• Configure enterprise SSO integration (SAML, LDAP)
• Set up API key management for external integrations

8. **Security Implementation**

• Configure rate limiting and brute force protection
• Set up account lockout and security monitoring
• Implement security headers and session security
• Configure audit logging and security event tracking
• Set up vulnerability scanning and security testing

9. **User Experience and Frontend Integration**

• Create responsive authentication UI components
• Implement client-side authentication state management
• Set up protected route handling and redirects
• Configure authentication error handling and user feedback
• Implement remember me and persistent login features

10. **Testing and Maintenance**

• Set up comprehensive authentication testing
• Configure security testing and penetration testing
• Create authentication monitoring and alerting
• Set up compliance reporting and audit trails
• Train team on authentication security best practices
• Create incident response procedures for security events