dabydat/alpha-omega/nestjs-authentication-oidc

Claude Code and agent skill by dabydat/alpha-omega

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

OIDC/PKCE/JWKS authentication patterns for NestJS. Covers OAuth2 flows, token validation, password hashing, and identity provider integration. Use when implementing OAuth authentication, OIDC flows, password hashing, or identity integration.

Install

npx vskill@latest install dabydat/alpha-omega/nestjs-authentication-oidc

SKILL.md

NestJS OIDC/PKCE Authentication

Why OIDC + PKCE

See references/why-oidc.md for the ❌ BAD custom-token-auth example, the ✅ OIDC + PKCE solution, and the flow overview diagram.

JWKS Key Generation

See references/jwks-generation.md for key types, rotation strategy, loading patterns, and the generator.

OIDC Provider Service

See references/oidc-provider.md for the full provider implementation, endpoint handling, and the custom /me endpoint.

OIDC handles: /authorize, /token, /userinfo, /.well-known/openid-configuration, /logout.

OIDC Controller

See references/oidc-controller.md for the logout + mounted OIDC endpoints.

Authorization Code Flow

Interaction Controller (Login/OTP Screens)

See references/interaction-controller.md for the full prompt handling (login/consent/OTP).

Custom UserInfo Endpoint

See references/oidc-provider.md for the /me handler implementation.

Password Hashing

See references/password-hashing.md for PBKDF2 implementation, migration patterns, and the HASHING_SERVICE port.

When to Use Which Algorithm
AlgorithmUse CaseNotes
PBKDF2Enterprise migration, compliance15000+ iterations
bcryptGeneral purposeAuto salt, work factor tuning
argon2New systems, high securityMemory-hard

Recommendation: For new systems, prefer argon2. For migration or compliance, PBKDF2.

Token Validation in Resource Servers

See references/resource-server-validation.md for JWKS validation, introspection, and the JwtAuthGuard.

Service Communication Patterns

See references/service-communication.md for TCP vs REST patterns and correlation ID propagation.

TCP vs REST for Auth Services
AspectTCPREST
LatencyLowerHigher
Client supportNestJS onlyAny HTTP client
Type safetyMessagePatternDTOs

Anti-Patterns to Avoid

See references/anti-patterns.md for the four ❌ examples (localStorage, no PKCE, no revoke, timing attacks) with fixes.

Summary: Auth Flow Responsibilities

ComponentResponsibility
JWKS GeneratorCreate RSA/ECDSA/EdDSA key pairs for signing
OIDC ProviderHandle auth endpoint, token exchange, discovery
Hashing ServicePBKDF2/bcrypt/argon2 password hashing
Interaction ControllerLogin form, consent screen, OTP verification
Token RepositoryStore access/refresh tokens with rotation
Auth GuardValidate JWTs using JWKS
/me EndpointReturn user claims

Golden rules:

  • Never store tokens insecurely. Use httpOnly cookies or secure storage.
  • Always use PKCE for public clients.
  • Use timing-safe comparison for hash verification.
  • Resource servers validate tokens using shared JWKS or introspection.

Related Skills

  • nestjs-guards-filters - Guards and exception filters for auth handling
  • nestjs-controllers - Controller patterns for API gateways
  • nestjs-ddd-patterns - DomainException base class

Security

  • Security scanPassed, 95 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dabydat/alpha-omega/nestjs-authentication-oidc/badge)](https://verified-skill.com/skills/dabydat/alpha-omega/nestjs-authentication-oidc)

Something wrong with this skill or its page? Tell us.