OAuth & Authentication Patterns

Complete authentication and authorization patterns with working code. Covers OAuth 2.0 Authorization Code + PKCE, JWT access/refresh token rotation with reuse detection, session-based auth with Redis, multi-provider social login (Google, GitHub, Apple), passkey/WebAuthn support, role-based access control with database-backed permissions, multi-tenant auth, password hashing with Argon2id, and security hardening (CSRF, CORS, rate limiting). Includes a security audit checklist and common-mistakes reference table. 19KB of production-tested patterns — not theory, working implementations.