#007 · SECURITY
Build a complete authentication system
Create a complete, security-hardened auth system for [framework]. Include:
(1) Registration with bcrypt (cost 12), email verification, welcome email trigger,
(2) Login with rate limiting 5 attempts/15min per IP, short-lived access token (15min)
+ refresh token (30 days) in httpOnly cookie,
(3) Refresh token rotation — detect reuse attacks and revoke ALL sessions,
(4) Forgot password with 1-hour single-use token,
(5) OAuth — Google & GitHub with account linking,
(6) 2FA with TOTP, QR code, and 10 backup codes...
💡 Pro tip: Never implement your own JWT signing. Ask Claude to add a security.md documenting all auth decisions for your team.
Next.js 14 + NextAuth v5 + Prisma