JWT strategy: RS256/EdDSA, JWKS rotation, refresh tokens, secure storage, revocation, multi-tenant.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Default: Web SPA → session cookie httpOnly opaca + refresh rotation. Mobile/APIs externas → JWT corto (RS256) + refresh rotado.
RS256 o EdDSA (Ed25519) — asimétricos. Private key firma, public key verifica via JWKS. Prohibido: HS256 en multi-service (shared secret), alg: none.
Estándar obligatorios: iss, sub (user ID), aud, exp, iat, nbf, jti (para revocación). Custom Educabot: tenant_id, roles, scope, user_version. Menores: NUNCA email/nombre/PII — solo sub (UUID) + tenant_id.
Access: 5-15 min. Refresh: 7-30 días, rotado en cada uso, en cookie httpOnly + DB.
Cada POST /auth/refresh: validar → marcar como rotated_at → emitir nuevo con misma family_id + parent_jti. Refresh ya rotado llega → reuse detectado → revocar toda la family.
/.well-known/jwks.json con claves públicas activas. Cache respetando Cache-Control (~10 min). Rotar cada 90 días: 2 kids activos durante overlap (emitir con nueva, validar con ambas). kid en JWT header.
exp no vencido, nbf ya pasadoiss matchea, aud incluye servicio actualjti no en blacklist (Redis)user_version matchea DB (si se usa)Go (golang-jwt), TS (jose), React (in-memory + cookie), React Native (expo-secure-store).
→ Read references/implementation.md for detalles por stack: Go, TS, React, React Native y CSRF
POST /auth/logout → delete refresh en DB → clear cookie (Max-Age=0) → frontend borra access in-memory. Access sigue válido hasta exp. Kill switch inmediato: jti a blacklist Redis con TTL = exp - now.
A) Blacklist jti: Redis SET revoked:<jti> 1 EX <ttl>. +1 Redis hit/request.
B) user_version (Default Educabot): user tiene version en DB (incrementa en logout-all/password change/role change). JWT incluye user_version. Middleware compara (cacheable). Más barato a escala.
tenant_id en claims obligatorio. Backend valida que recursos pertenezcan a tenant_id del JWT. Prohibido pasar tenant_id por query/body.
→ Read references/anti-patterns.md for tabla completa (12 items) con remediación
→ Read references/checklist.md for checklist completo (11 items)
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Plan, design, and implement A/B tests and experiments with statistical rigor. Covers hypothesis frameworks, sample sizing, metrics, and result analysis.
The English summary is being prepared. Showing the original description.
Web/mobile accessibility decision guide: WCAG 2.2 AA, ARIA, keyboard nav, focus management, contrast, testing. Use for: a11y, accessibility, wcag, aria, screen reader, keyboard, contrast.
The English summary is being prepared. Showing the original description.
Generate, iterate, and scale ad creative for paid advertising across Google, Meta, LinkedIn, and X. Covers platform specs, creative frameworks, and quality validation.
The English summary is being prepared. Showing the original description.
Musica interactiva para juegos: layering vertical, re-secuenciacion horizontal, stingers, reglas de transicion con sync points, y mapeo de estados de gameplay a musica. Usar para: musica adaptativa, sistema de musica dinamica, transiciones musicales, combat music.
The English summary is being prepared. Showing the original description.
Design multi-agent systems, create agent architectures, define communication patterns, and build autonomous agent workflows with structured evaluation frameworks.
The English summary is being prepared. Showing the original description.
Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, response formats, and quality loops.
The English summary is being prepared. Showing the original description.