---
name: auth-boundaries
description: "Add identity and object-level authorization to server applications. Use for auth, sessions, authorization."
---

# Границы авторизации

Add identity and object-level authorization to server applications.

## Implementation decisions

1. Reuse a proven identity provider; avoid custom password crypto.
2. Verify identity on the server and ownership on each object operation.
3. Use secure HttpOnly SameSite cookies with CSRF protection suited to the auth model.
4. Keep secrets out of browser bundles, skill archives and logs.

## Working source

Read [references/backend-boundaries.md](../webcraft-shared/source/references/backend-boundaries.md) when implementing this capability. The example belongs to the WEBCRAFT React/Three.js playground except the Python commerce starter, which runs without third-party dependencies. Use [shared catalog](../webcraft-shared/source/lib/catalog.ts) only to resolve related examples. Adapt the source to the target framework and preserve existing project conventions.

## Verify observable behavior

- Changing an ID cannot read another user’s record.
- Unauthenticated mutations are rejected.
- Session expiry has a recovery flow.

## Scope

Use only the parts relevant to the requested task. This skill does not grant permission to publish, spend money, change account access or expose secrets. The original brief and environment rules remain authoritative.

Version 2.0.0 · Original WEBCRAFT content · MIT