Auth Middleware Builder

Auth Middleware Builder generates secure, production-tested authentication and authorization patterns for REST APIs. It understands the security implications of every decision and generates code that is both correct and auditable.

Authentication Strategies

JWT Bearer Authentication - Token validation with proper algorithm pinning (RS256 or HS256) - Claims extraction and type-safe request enrichment - Token expiration and refresh handling - Revocation support via token denylist (Redis)

API Key Authentication - Hashed key storage (never store plaintext API keys) - Key prefix for identification without exposing the secret - Per-key metadata: owner, scopes, expiration, rate limit tier

OAuth2 / OIDC - Token introspection against authorization server - JWT signature verification using JWKS endpoint - Scope-based access control

Authorization Patterns

Role-Based Access Control (RBAC) ``` roles: ["admin", "editor", "viewer"] permissions: { "posts:write": ["admin", "editor"], "posts:read": ["viewer"] } ```

Attribute-Based Access Control (ABAC) Policy evaluation functions for complex resource ownership checks.

Framework Support

• Express.js — middleware functions and error handlers
• Fastify — hooks and decorators
• FastAPI — dependency injection pattern
• Echo (Go) — middleware groups

Security Defaults

All generated code defaults to secure settings: strict algorithm validation, short JWT expiry, HttpOnly cookie flag for web apps, and constant-time comparison for secrets.