auth-server-primitives

Store the session token in an HttpOnly, Secure, SameSite=Lax cookie with the __Host- prefix, then load it in a createMiddleware server function that attaches the session to context. Apply that middleware to every server function that touches private data.

Enforce auth inside the server function handler or via middleware, not in route beforeLoad guards. Route guards only affect page navigation; RPC endpoints remain directly callable, so each protected createServerFn needs its own auth check.

SameSite=Lax blocks most cross-site POST CSRF but does not block requests from sibling subdomains. For non-GET requests, also verify the Origin header matches your app's full origin in middleware.

Return the same 200 response and identical body whether or not the email exists, and perform equivalent work in both branches to avoid timing leaks. Never use different messages or status codes for registered versus unregistered emails.

Module-level code runs before any request exists, so request headers are unavailable, and on edge runtimes like Cloudflare Workers environment variables are injected per request. Read cookies and secrets inside handler or middleware callbacks instead.