Authentication Flow Designer

Design secure authentication flows covering every aspect of user identity management.

**Application Type:** [WEB APP / MOBILE APP / API-ONLY / ENTERPRISE SAAS]
**Auth Method Preference:** [JWT SESSION-BASED / OAUTH2 / OIDC / SAML (SSO)]

**Flow Components to Design:**

**Login Flow:**
- Email/password with rate limiting (5 attempts per 15 minutes)
- Password strength requirements and real-time validation feedback
- "Remember me" functionality with extended token lifetime
- Account lockout policy after failed attempts
- CAPTCHA integration threshold (after 3 failures or suspicious IP)

**Registration Flow:**
- Email verification with time-limited tokens (24-hour expiry)
- Duplicate email detection before password creation
- Social sign-up flow (Google, GitHub, Apple) with account linking logic
- Terms of service acceptance tracking with version stamping

**Password Reset:**
- Token-based reset with single-use constraint and 1-hour expiry
- Rate limiting per IP and per email address
- Password change confirmation requiring current password
- Notification to account owner of password change (security alert)

**Email Verification:**
- Resend verification email with cooldown period (60 seconds between requests)
- Auto-expiry of unverified accounts after 7 days
- Verification link with cryptographic token validation

**OAuth Social Login:**
- Google, GitHub, Apple OAuth2 flows with proper redirect URIs
- Account linking logic for users who register via email then connect social
- Scope minimization (request only necessary data)
- State parameter for CSRF protection on OAuth flows

**MFA/2FA:**
- TOTP (Time-based One-Time Password) setup with QR code and manual entry fallback
- Backup codes generation (10 single-use codes)
- SMS 2FA as fallback option (with security warning about SIM swapping)
- Device trust option (remember trusted device for 30 days)

**Session Management:**
- JWT access token lifetime (15 minutes recommended)
- Refresh token rotation strategy with absolute expiry (7-30 days)
- Concurrent session limits and management UI
- Session revocation on password change or security event
- Idle timeout with automatic logout warning modal

**Security Headers & Compliance:**
- Secure, HttpOnly, SameSite=Strict cookie attributes
- CSRF token implementation for state-changing operations
- OWASP authentication cheat sheet compliance checklist
- GDPR right-to-be-forgotten implementation (complete data deletion flow)
- Audit logging of all auth events (login success/failure, password change, MFA toggle)

How to Customize It

Replace each bracketed placeholder with your own details before running the prompt. The more specific you are, the better the output — vague inputs produce generic results.

• [WEB APP / MOBILE APP / API-ONLY / ENTERPRISE SAAS]Swap in your web app or mobile app or api-only or enterprise saas.
• [JWT SESSION-BASED / OAUTH2 / OIDC / SAML (SSO)]Swap in your jwt session-based or oauth2 or oidc or saml (sso).

When to Use It

• Adding auth to a new app and deciding between sessions, JWTs, or delegating everything to an identity provider.
• Security-reviewing an existing auth flow — generate the reference design, then diff your implementation against it.
• Planning enterprise SSO (SAML/OIDC) support without absorbing three RFCs first.

Tips for Better Results

• 1The right answer is often "don't build it" — ask the prompt to compare rolling your own against Auth0/Clerk/Cognito for your case first.
• 2Specify where tokens will live (httpOnly cookie vs. memory vs. localStorage) and ask for the XSS/CSRF implications of that choice.
• 3Have it enumerate the abuse cases (credential stuffing, enumeration via error messages, reset-token leaks) and check each against your design.