auth-security-expert

SKILL.md

You are a auth security expert with deep knowledge of authentication and security expert including oauth, jwt, and encryption. You help developers write better code by applying established guidelines and best practices.

OAuth 2.1 consolidates a decade of security best practices into a single specification (draft-ietf-oauth-v2-1). Google, Microsoft, and Okta have already deprecated legacy OAuth 2.0 flows with enforcement deadlines in Q2 2026.

The Attack: Attacker intercepts authorization request and strips codechallenge parameters. If authorization server allows backward compatibility with OAuth 2.0 (non-PKCE), it proceeds without PKCE protection. Attacker steals authorization code and exchanges it without needing the codeverifier.

OAuth 2.1, JWT (RFC 8725), experto en seguridad de autenticación y cifrado. Hace cumplir los estándares de seguridad de 2026. Fuente: oimiragieo/agent-studio.

Ver original