Session Management

This handles the full authentication state lifecycle: JWT generation and validation, token refresh flows, Redis-backed session storage, CSRF protection, and proper logout cleanup. You get working examples in both Python/Flask and Node.js/Express, plus middleware chains that validate tokens on every request. The skill covers the security fundamentals you actually need: httpOnly cookies, proper token expiration, strong secrets, and session timeout handling. It's opinionated about not using localStorage for tokens and always running over HTTPS, which is the right call. Good for building login systems from scratch or fixing security gaps in existing auth flows.

skills.sh installs: 466
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill session-management --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive session management systems with secure token handling, session persistence, token refresh mechanisms, proper logout procedures, and CSRF protection across different backend frameworks.

When to Use

Implementing user authentication systems
Managing session state and user context
Handling JWT token refresh cycles
Implementing logout functionality
Protecting against CSRF attacks
Managing session expiration and cleanup

Quick Start

Minimal working example:

# Python/Flask Example
from flask import current_app
from datetime import datetime, timedelta
import jwt
import os

class TokenManager:
    def __init__(self, secret_key=None):
        self.secret_key = secret_key or os.getenv('JWT_SECRET')
        self.algorithm = 'HS256'
        self.access_token_expires_hours = 1
        self.refresh_token_expires_days = 7

SKILL.md on GitHub