# broken-authentication

This skill guides security checks for web login flows, password rules, and session handling. Use it when reviewing authentication controls or multi-factor login.

- skill · `type=skill` · Claude Code · 269 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/broken-authentication
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/broken-authentication

## What it does

The skill lays out a workflow for examining how a web application authenticates users. It covers password requirements, account discovery through server responses, and controls that restrict repeated login attempts. Other checks focus on password guessing and attempts to log in with credentials exposed in earlier breaches.

Session checks examine token randomness, predictable values, cookie security attributes, and whether login replaces the previous session identifier. The workflow also covers expiration, logout invalidation, and weaknesses in multi-factor authentication. Burp Suite, Hydra, and browser developer tools are among the listed utilities. A Python example uses the `requests` library to collect session cookies for analysis.

Testing requires the target application's URL, test credentials, and written permission from its owner. Familiarity with HTTP, cookies, and authentication methods is also expected. Do not run credential attacks against systems without authorization.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/broken-authentication
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill broken-authentication -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/broken-authentication/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/broken-authentication/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/broken-authentication/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/broken-authentication/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates broken-authentication
```

2. **Manually: put the files in place**
- File: `.github/skills/broken-authentication/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/broken-authentication
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/broken-authentication/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/broken-authentication

## When to use it
- Inspect password length and complexity requirements
- Detect responses that reveal whether an account exists
- Assess login throttling and defenses against reused leaked credentials
- Check session token predictability and expiration behavior
- Find weaknesses in multi-factor authentication flows

## Example prompts
- Review my web application's password rules and check whether login responses reveal valid accounts.
- Audit session handling, including cookie flags, expiration, and session ID rotation after login.
- Prepare an authorized test plan for login rate limits and multi-factor authentication bypass risks.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md