auth-server-primitives

Use setResponseHeader to set a Set-Cookie header with HttpOnly, Secure, SameSite=Lax, Path=/, and a Max-Age, preferably with the __Host- prefix. Read the token back per-request with getRequestHeader('cookie') inside a handler or middleware, never at module scope.

Enforce auth inside the server function itself using createMiddleware that loads the session and throws if invalid, then attach it via .middleware([authMiddleware]). Route guards with beforeLoad only protect page UX; RPC endpoints remain directly callable without handler-level checks.

SameSite=Lax blocks most cross-site POST CSRF but does not block requests from sibling subdomains. Add middleware that verifies the Origin header matches your app's full origin for every non-GET request, including server routes and SSR.

Module-level reads of process.env evaluate before any request exists and return undefined on edge runtimes where env is injected per-request. Read secrets inside the per-request handler or middleware callback instead of at module scope.

Return the same 200 response and identical body whether or not the email exists, and perform equivalent work in both branches. For login, verify against a dummy password hash when the user is missing so timing does not reveal account existence.

Rotate on every privilege change: login, logout, password change, and role or permission grants. Destroy the old session server-side and issue a fresh token to neutralize session-fixation attacks where an attacker plants a session ID before login.