authentication-flow

Files (1)

• SKILL.md

SKILL.md (first lines)

# Authentication Flows

## Sign Up
- **Minimum fields:** Email and password (or just email for magic link)
- **Social sign-in** options above the form (Google, GitHub, Apple)
- **Password requirements** shown proactively, not after failed attempt
- **Email verification** via link, not code (less friction)

## Log In
- Email + password as default
- "Remember me" checkbox
- "Forgot password?" link visible near password field
- Show/hide password toggle
- Rate limit failed attempts (show "try again in X seconds")

## Password Reset
1. Enter email → 2. Check email → 3. Set new password → 4. Confirmed
- Don't confirm whether the email exists (security)
- Reset links expire (1 hour typical)
- Invalidate old passwords on reset

## Multi-Factor Authentication
- SMS codes are the minimum (but weakest)
- Authenticator apps are better (TOTP)
- Passkeys/WebAuthn are best (no codes needed)
- Recovery codes: show once, make user save them
- Don't force MFA setup during onboarding (ask after first valuable action)

## Single Sign-On
- Prominent SSO buttons with correct brand colors and logos
- "Continue with Google" not "Sign in with Google" (works for both login and signup)
- Handle account linking (same email, different auth method)

## Session Management
- Show active sessions in settings
- Allow remote logout
- Auto-logout after inactivity (configurable for sensitive apps)
- Extend session silently on activity (no popup interruptions)

From Dragoon0x/everything-design-taste, MIT.

More from Dragoon0x/everything-design-taste