fix-auth-access
Fix authentication, session, role, tenant-isolation, and object-access bugs on the server with a single ownership helper applied to every route, verified in both directions and on old and new records. Use for IDOR, data leaks across users, session, cookie, or role bugs.
72
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
Fix Auth and Access
Procedure
- One helper owns the rule (
requireOwner/ownAudit): missing or not owned → 404, so existence isn't revealed. Every lookup uses it: API, pages, exports, search, checkout, delete. - Scope every collection query by owner or tenant inside the query, not after.
- Sessions: logout deletes the server session and expires the cookie; cookies are
HttpOnly; SameSite=Lax; Secureon HTTPS; identity never comes from a posted email or ID. - Roles: check on every request, not only at login; a downgrade takes effect immediately.
- Prove both directions (A→B, B→A), signed-out access, aged records, a real-browser user-agent, and production config. Each was a cheat our Done-Gate caught.
- Run the sweep and log review from
fix-security-hotfixif data may have leaked.
Exit criteria
The ownership matrix (role × object × action) passes, including the hidden both-directions and aged-record tests.
Counterpart of tester skill: qa-auth-access.
- Repository
itsablabla/qa-bug-agent-skills
- Revision
9a6f628
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.