version: "1.0.1" name: auth-authz-review description: Reviews authentication and authorization logic - JWT handling, OAuth/OIDC flows, session management, password reset, MFA, and access control. Use when code touches login, tokens, sessions, or permission checks.

Auth & Authz Review

Builds on secure-code-review. Authentication (who are you) and authorization (what can you do) are distinct failure modes with distinct evidence requirements — don't conflate a missing authorization check with a missing authentication check.

• JWT
• OAuth / OIDC
• Session Management
• Password Reset
• MFA
• Access Control

When to Use

Whenever the architecture model identifies an authentication mechanism, or the attack surface map flags an entry point touching login, session, token issuance/validation, password reset, MFA enrollment/verification, or any authorization-gated resource — routed here per workflow/routing_rules.yaml.

Core Discipline

• Authorization checks must be searched for beyond the immediate handler. A missing check in a controller is not evidence of a vulnerability if a middleware, service-layer check, or ORM-level scoping enforces it elsewhere — see access-control.md and agents/security-verifier.md's Authorization Validation.
• "Authenticated" is not "authorized." Confirm which specific check (if any) constrains which resources an authenticated user can act on, not just whether they're logged in.
• Prefer framework/library mechanisms over custom implementations as the default-safe case — but verify the framework mechanism is actually configured correctly (e.g. JWT signature verification actually enabled, not just present in the dependency tree).

Output

A candidate finding conforming to finding.schema.json. Common categories: authentication-bypass, broken-object-level-authorization, broken-function-level-authorization, session-fixation, insecure-token-handling.