auth-tls-patterns Skill

Source

• Creator: microsoft
• Repository: microsoft/amplifier-bundle-skills
• Skill file: skills/auth-tls-patterns/SKILL.md

What it does

Use when a service needs auth that stays frictionless locally but secures remote access, or automatic TLS. Covers token-based auth with auto-generation, localhost bypass, and certificate setup.

Skill instructions

Authentication & TLS The Pattern Problem: Your tool serves a web UI. Locally it should just work — no passwords, no login screens. Remotely it needs real authentication and HTTPS. You don't want to configure either manually. Approach: Socket-level localhost bypass (unforgeable), cascading auth strategies with auto-generation, and a TLS setup cascade that picks the best available method automatically. Pattern proven in production across multiple Python CLI tools and web services. Key Design Decisions 1. Localhost bypass — socket-level IP, not headers The single most important auth decision: localhost connections skip all auth checks. But you MUST use the socket-level client IP, not HTTP headers: python LOCALHOSTADDRS = {"127.0.0.1", "::1"} async def dispatch(self, request: Request, callnext) - Response: client.host is the socket-level IP — cannot be forged by the client clienthost = request.client.host if request.client else "" if clienthost in LOCALHOSTADDRS: return await callnext(requ