authentication-best-practices

Validate and enforce authentication state on client and server with Better Auth.

20|3|Updated Nov 30, 2025

Search Tags:#security #authentication #routing #server #sessions #client

Ready to run

npx skills add https://github.com/andrelandgraf/fullstackrecipes --skill authentication-best-practices

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: authentication-best-practices
Source: https://github.com/andrelandgraf/fullstackrecipes/tree/main/templates/fullstackrecipe/.agents/skills/authentication-best-practices
Command: npx skills add https://github.com/andrelandgraf/fullstackrecipes --skill authentication-best-practices

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manage and verify user authentication state across client and server, enabling secure access to pages and APIs with predictable behavior.

Core Features & Use Cases

Client-side and server-side session handling with Better Auth integration.
Route guarding to redirect unauthenticated users and protect sensitive pages or APIs.
Sign in / sign up / sign out flows using the Better Auth client and server APIs.

Quick Start

Install the Better Auth setup, then implement client and server session checks to guard a protected page.

Frequently Asked Questions about authentication-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I guard routes and APIs with client and server sessions?▼

To guard routes with client and server sessions, you validate authentication state on both sides. This approach protects pages and APIs by redirecting unauthenticated users and enforcing user identity checks before access.

Can I use Better Auth for sign in, sign up, and sign out flows?▼

Yes, you can implement sign in, sign up, and sign out flows using the Better Auth client and server APIs. It manages user identity by handling client-side and server-side sessions for secure full-stack authentication.

What is the best way to protect sensitive pages in a full-stack application?▼

The best way to protect sensitive pages is route guarding that validates authentication state on both client and server. This ensures unauthenticated users are redirected and prevents unauthorized access to protected APIs and data fetches.

Do I need both client and server session checks to protect API endpoints?▼

Yes, validating and enforcing authentication state on both client and server is required to protect API endpoints. This dual session validation ensures predictable behavior and secures data fetches based on verified user identity.

Does this authentication approach work for full-stack data fetches?▼

Yes, this approach applies to full-stack applications that protect data fetches based on user identity. It manages and verifies authentication state across client and server to secure access to pages and APIs.