moai-security-auth0
Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements.
Best use case
moai-security-auth0 is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements.
Teams using moai-security-auth0 should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/moai-security-auth0/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How moai-security-auth0 Compares
| Feature / Agent | moai-security-auth0 | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Auth0 Security Specialist Comprehensive security skill for Auth0 implementations covering attack protection, multi-factor authentication, token security, sender constraining (DPoP/mTLS), and regulatory compliance (FAPI, GDPR, HIPAA). ## Quick Reference ### Security Feature Categories Attack Protection: - Bot Detection: CAPTCHA challenges for suspicious traffic - Breached Password Detection: Blocks compromised credentials - Brute Force Protection: Limits failed login attempts per account - Suspicious IP Throttling: Rate limits high-velocity attacks Multi-Factor Authentication: - Push notifications via Auth0 Guardian - One-time passwords (TOTP) - WebAuthn with security keys and biometrics - SMS/voice verification and Adaptive MFA Token Security: - JWT structure and validation - Access token management with scopes - Refresh token rotation and expiration - Token revocation strategies Sender Constraining: - DPoP: Application-layer token binding - mTLS: Transport-layer certificate binding Compliance: FAPI, GDPR, HIPAA/HITECH, PCI DSS, ISO 27001, SOC 2 ### Dashboard Navigation Attack Protection: Dashboard > Security > Attack Protection MFA Configuration: Dashboard > Security > Multi-factor Auth Security Center: Dashboard > Security > Security Center ### Essential Setup Checklist 1. Enable Bot Detection with appropriate sensitivity 2. Activate Breached Password Detection 3. Configure Brute Force Protection thresholds 4. Enable Suspicious IP Throttling 5. Set up at least one MFA factor 6. Configure token expiration policies --- ## Implementation Guide ### Attack Protection Bot Detection: Navigate to Dashboard > Security > Attack Protection > Bot Detection. Configure sensitivity (Low/Medium/High) and response type (Auth Challenge recommended, Simple CAPTCHA, or third-party). IP AllowList supports up to 100 addresses/CIDR ranges. Supported flows: Universal Login, Classic Login, Lock.js v12.4.0+, native apps. Unsupported: Enterprise connections, social login, cross-origin authentication. Breached Password Detection: Enable for signup and login. Response actions include blocking compromised credentials and user/admin notifications. Standard Detection has 7-13 months detection time; Credential Guard (Enterprise) reduces to 12-36 hours. Test with passwords starting with AUTH0-TEST-. Brute Force Protection: Default threshold is 10 failed attempts (configurable 1-100). Protection mechanisms include IP-based blocking and account lockout. Blocks remove after 30 days, password change, admin removal, or user unblock link. Suspicious IP Throttling: Velocity-based detection for high-volume attacks. Responds with HTTP 429. Configure separate thresholds for login (daily) and signup (per minute) attempts. For details: modules/attack-protection-overview.md ### Multi-Factor Authentication Factor Configuration: Navigate to Dashboard > Security > Multi-factor Auth. Independent Factors (at least one required): - WebAuthn with FIDO Security Keys - One-time Password (OTP/TOTP) - Push Notifications via Auth0 Guardian - Phone Message (SMS/Voice) - Cisco Duo Security Dependent Factors: WebAuthn Biometrics, Email, Recovery codes MFA Policies: Never, Use Adaptive MFA (Enterprise), Always WebAuthn: Provides passwordless MFA with security keys or biometrics. Single interaction for multi-factor authentication, phishing-resistant. Adaptive MFA (Enterprise): Evaluates risk signals per transaction: - NewDevice: Device not used in past 30 days - ImpossibleTravel: Geographic anomalies - UntrustedIP: Suspicious activity history High-risk transactions require verification regardless of existing MFA sessions. Step-Up Authentication: Enhanced verification for sensitive operations. APIs use scopes; web apps verify ID token claims. For details: modules/mfa-overview.md, modules/adaptive-mfa.md ### Token Security JWT Fundamentals: RFC 7519 standard. Auth0 issues signed JWTs (JWS). Structure includes Header, Payload (claims), and Signature. Always validate signatures, never store sensitive data in payloads, use HTTPS only. Access Tokens: Authorize API access with scopes. Types: Opaque (require introspection) and JWT (self-contained). Key claims: iss, sub, aud, scope, exp. Default lifetime: 86400 seconds (24 hours). Refresh Tokens: Enable session continuity. Maximum 200 active per user per application. Security features: Rotation (invalidates predecessor), expiring tokens (idle/absolute), revocation via Management API. Best Practices: - Treat signing keys as critical credentials - Prefer RS256 over HS256 for public key validation - Store tokens server-side when possible - Cache and reuse until expiration For details: modules/tokens-overview.md, modules/token-best-practices.md ### Sender Constraining DPoP (Application Layer): Binds tokens to client-generated asymmetric key pairs. Steps: Generate key pair (ES256 recommended), create DPoP Proof JWT, send via DPoP header, include updated proof with each API request. Proof JWT Structure: - Header: typ (dpop+jwt), alg, jwk (public key) - Payload: jti, htm, htu, iat, ath (for API calls) Public clients must handle use_dpop_nonce errors. mTLS (Transport Layer): Binds tokens to X.509 certificates. Process: Client establishes mTLS connection, Auth0 calculates certificate SHA-256 thumbprint, embeds in token cnf claim as x5t#S256. Resource server validates thumbprint. Requirements: Confidential clients only, Enterprise Plan with HRI add-on, PKI infrastructure. For details: modules/dpop-implementation.md, modules/mtls-sender-constraining.md ### Compliance Highly Regulated Identity (Enterprise + HRI add-on): - Strong Customer Authentication: Minimum two independent factors - Dynamic Linking: Transaction details in authorization - PAR: Pushed Authorization Requests - JAR: JWT-Secured Authorization Requests - JWE: Access token encryption - Private Key JWT and mTLS authentication GDPR Compliance: - Customer as Data Controller, Auth0 as Data Processor - User rights: Access, portability (JSON export), erasure, consent management - Security: Profile encryption, breach detection, brute-force protection Certifications: ISO 27001/27017/27018, SOC 2 Type 2, CSA STAR, FAPI 1 Advanced OP, HIPAA BAA available, PCI DSS compliant models For details: modules/highly-regulated-identity.md, modules/gdpr-compliance.md --- ## Advanced Patterns ### Security Center Monitoring Access from Dashboard > Security > Security Center. Threat Categories: - Credential Stuffing: Machine-driven compromise attempts - Signup Attacks: Automated account creation - MFA Bypass: Circumvention attempts Filtering: Time period (up to 14 days), applications, connections. Auto-aggregation by minute/hour/day. Metrics: Bot detection counts, IP throttling events, brute force triggers, breached password alerts, MFA success/failure rates. ### Application Credentials Client Secret (Default): Symmetric, simple but vulnerable to interception. Private Key JWT (Enterprise): Asymmetric key pairs, private key never transmitted, short-lived assertions. Recommended for enhanced security. mTLS for OAuth (HRI): X.509 certificates, strongest protection. Key Management: Register up to two public keys for zero-downtime rotation. Algorithms: RS256, RS384, PS256. ### Continuous Session Protection Use Auth0 Actions for session context during token refresh events. Capabilities: IP/ASN monitoring, device tracking, expiration management, anomaly detection. Dynamic management: Customize lifetimes by user attributes, organization, or role. --- ## Module Reference Attack Protection: - modules/attack-protection-overview.md - modules/bot-detection.md - modules/breached-password-detection.md - modules/brute-force-protection.md - modules/suspicious-ip-throttling.md - modules/akamai-integration.md - modules/attack-protection-log-events.md - modules/state-parameters.md MFA: - modules/mfa-overview.md - modules/mfa-factors.md - modules/webauthn-fido.md - modules/adaptive-mfa.md - modules/guardian-configuration.md - modules/step-up-authentication.md - modules/mfa-api-management.md - modules/customize-mfa.md - modules/ropg-flow-mfa.md Tokens: - modules/tokens-overview.md - modules/jwt-fundamentals.md - modules/id-tokens.md - modules/access-tokens.md - modules/delegation-tokens.md - modules/refresh-tokens.md - modules/token-revocation.md - modules/token-best-practices.md Sender Constraining: - modules/dpop-implementation.md - modules/mtls-sender-constraining.md Compliance: - modules/compliance-overview.md - modules/fapi-implementation.md - modules/highly-regulated-identity.md - modules/gdpr-compliance.md - modules/certifications.md - modules/tenant-access-control.md - modules/customer-managed-keys.md Security Operations: - modules/security-center.md - modules/application-credentials.md - modules/continuous-session-protection.md - modules/security-guidance.md - modules/mdl-verification.md --- ## Works Well With - moai-platform-auth0: Platform integration patterns - expert-security: General security analysis - moai-platform-clerk: Alternative authentication comparison - moai-lang-typescript: TypeScript SDK implementations - moai-lang-python: Python SDK implementations - moai-domain-backend: API security integration --- ## Resources Official Documentation: - https://auth0.com/docs/secure - https://auth0.com/docs/secure/attack-protection - https://auth0.com/docs/secure/multi-factor-authentication - https://auth0.com/docs/secure/tokens - https://auth0.com/docs/secure/sender-constraining - https://auth0.com/docs/secure/data-privacy-and-compliance Context7: Library /auth0/auth0-docs for latest API documentation
Related Skills
security-auditor
Activates when user needs security review, vulnerability scanning, or secure coding guidance. Triggers on "security review", "find vulnerabilities", "is this secure", "check for injection", "security audit", "OWASP", "secure this code", or security-related questions.
security-audit
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
security-audit-scanner
Automated security scanning for Vigil Guard v2.0.0. Use for OWASP Top 10 checks, TruffleHog secret detection, npm/pip vulnerability scanning, 3-branch service security, heuristics-service audit, and CI/CD security pipelines.
security-audit-example
Example security audit skill demonstrating how to audit code for security vulnerabilities. Use when the user asks to perform security reviews, check for vulnerabilities, or audit code security.
security-audit-agent
Performs comprehensive security audits of codebases, identifying vulnerabilities and security best practices
security-assessment
Execute threat modeling, vulnerability scanning, and security control validation. Use when relevant to the task.
security
Security Engineer and application security expert. Performs threat modeling, security architecture review, penetration testing, vulnerability assessment, and security compliance. Handles OWASP Top 10, authentication security, authorization, encryption, secrets management, HTTPS/TLS, CORS, CSRF, XSS, SQL injection prevention, secure coding practices, security audits, and compliance (GDPR, HIPAA, PCI-DSS, SOC 2). Activates for security, security review, threat model, vulnerability, penetration testing, pen test, OWASP, authentication security, authorization, encryption, secrets, HTTPS, TLS, SSL, CORS, CSRF, XSS, SQL injection, secure coding, security audit, compliance, GDPR, HIPAA, PCI-DSS, SOC 2, security architecture, secrets management, rate limiting, brute force protection, session security, token security, JWT security, is this secure, security check, review security, find vulnerabilities, security scan, security test, hack proof, prevent hacking, protect from attacks, DDoS protection, bot protection, WAF, web application firewall, input validation, sanitize input, escape output, parameterized queries, prepared statements, password hashing, bcrypt, argon2, salt, pepper, secure password, password policy, MFA, 2FA, two factor, multi factor, OAuth security, OIDC, OpenID Connect, SAML, SSO security, API key security, Bearer token, refresh token rotation, token expiration, session hijacking, session fixation, clickjacking, open redirect, SSRF, XXE, insecure deserialization, broken access control, security misconfiguration, sensitive data exposure, insufficient logging, dependency vulnerability, npm audit, snyk, dependabot, CVE, security patch, zero day, security incident, data breach, data leak, privacy, data protection, encryption at rest, encryption in transit, key management, KMS, HSM, certificate management, cert rotation, security headers, CSP, Content Security Policy, X-Frame-Options, X-XSS-Protection, HSTS, Strict-Transport-Security.
security-analysis
Security audit patterns including OWASP Top 10, secret scanning, and language-specific vulnerabilities.
reviewing-security
Executes security design and implementation reviews with threat modeling, OWASP-based checks, and risk-ranked remediation guidance. Activates when reviewing security, threat modeling, checking for vulnerabilities, auditing auth flows, performing OWASP reviews, or assessing security posture. Does not handle code quality or test coverage (code-reviewer), writing production code (backend-developer or frontend-developer), or infrastructure deployment (devops).
redis-security
Master Redis security - authentication, ACL, TLS encryption, network hardening, and production security best practices
QE Security Compliance
Security auditing, vulnerability scanning, and compliance validation for OWASP, SOC2, GDPR, and other standards.
program-security-basics
Baseline security checklist for Solana programs: authority checks, input validation, upgrade keys, unsafe patterns, and attack surfaces. Use for design reviews and pre-deploy audits.