Auth is the most common piece of code AI generates incorrectly. The AI usually implements basic auth when you need JWT or OAuth. Here is the auth template I use for every project.
What auth pattern should you prompt the AI to use?
Supabase Auth with Google OAuth for web apps. Magic link for simpler projects. JWT for API-only services. I always include the exact auth library and version in my spec. The AI defaults to whatever pattern it trained on, which may be outdated. I wrote a template spec for auth that I paste before every AI session.
What auth mistakes does the AI make most often?
Storing tokens in localStorage instead of httpOnly cookies. Not refreshing tokens. Not handling token expiration gracefully. Allowing signup without email verification. These are security issues, not just bugs. I catch them with a security-focused code review after every AI generation.
Leave a Reply