skills.rest
AdamAbd
AdamAbdCOMMUNITY
Explore all skills by this author →
Website𝕏@AdamAbdurrahmaGitHub

better-auth-security-best-practices

Configure Better Auth security with secrets, rate limits, CSRF, and session protections.

Updated Feb 16, 2026
Search Tags:#security#oauth#better-auth#auditing#csrf#secret-management#cookie-security
One-click install
npx skills add https://github.com/AdamAbd/netlify-todo --skill better-auth-security-best-practices-adamabd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: better-auth-security-best-practices
Source: https://github.com/AdamAbd/netlify-todo/tree/main/.agents/skills/better-auth-security-best-practices
Command: npx skills add https://github.com/AdamAbd/netlify-todo --skill better-auth-security-best-practices-adamabd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a comprehensive blueprint for implementing security features across Better Auth, including secret management, rate limiting, CSRF protection, trusted origins, session and cookie security, OAuth safeguards, IP-based controls, and auditing.

Core Features & Use Cases

  • Secret Management: manage and validate signing secrets, rotate keys safely, and enforce secure storage practices.
  • Rate Limiting: protect endpoints from brute-force attacks with configurable per-endpoint rules, storage options, and automatic protections.
  • CSRF Protection: multi-layer defenses including origin checks, fetch metadata analysis, and safe defaults.
  • Trusted Origins: enforce allowed origins, wildcards, and dynamic origin computation for secure redirects.
  • Session & Cookie Security: robust session expiration, cookie attributes, and cross-subdomain settings.
  • OAuth / Social Provider Security: PKCE enforcement, secure state handling, and token encryption.
  • IP-Based Security: header-based IP tracking, IPv6 subnet grouping, and trusted proxy headers.
  • Database Hooks for Security Auditing: hooks to emit audit events on key operations.
  • Background Tasks for Timing Attack Prevention: ensure operations complete in constant time where possible.
  • Account Enumeration Prevention: uniform responses and dummy operations to obscure user existence.
  • Complete Security Configuration Example: end-to-end sample configuration.

Quick Start

Configure your Better Auth instance with a strong secret, trusted origins, and enabled security features to start securing your app.

Frequently Asked Questions about better-auth-security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Better Auth for secure session management and cookie security?▼

Secure Better Auth session management by configuring robust session expiration, setting strict cookie attributes, and applying cross-subdomain settings. This ensures cookies are protected against unauthorized access and session hijacking across your application domains.

What's the best way to implement CSRF protection and trusted origins in Better Auth?▼

Implement Better Auth CSRF protection using multi-layer defenses including origin checks, fetch metadata analysis, and safe defaults. Enforce trusted origins by configuring allowed origins, wildcards, and dynamic origin computation for secure redirects.

How do I manage and rotate signing secrets safely in Better Auth?▼

Manage Better Auth signing secrets by validating existing keys, rotating them safely, and enforcing secure storage practices. This prevents unauthorized token usage and maintains secure authentication operations during key transitions.

Does Better Auth support OAuth safeguards like PKCE and token encryption?▼

Better Auth supports OAuth security by enforcing PKCE, handling secure state, and encrypting tokens. These safeguards prevent authorization code interception and protect social provider authentication flows.

Can I use Better Auth to prevent account enumeration and timing attacks?▼

Better Auth prevents account enumeration using uniform responses and dummy operations to obscure user existence. It also runs background tasks to ensure operations complete in constant time, mitigating timing attack vulnerabilities.

How do I set up database hooks for security auditing and IP tracking in Better Auth?▼

Set up Better Auth database hooks to emit audit events on key operations for security auditing. Configure IP-based security using header-based IP tracking, IPv6 subnet grouping, and trusted proxy headers to monitor access.

Related Skills

Explore More Software Engineering Skills→
AutumnsGroveAutumnsGrove
5

better-auth-best-practices

Configure and harden Better Auth with security best practices.

Community
Advanced
brucesongsbrucesongs
60

logging-monitoring

Identify and remediate security logging and monitoring gaps across environments.

Community
Advanced
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced
Razaib-khanRazaib-khan

configuring-better-auth

Configure Better Auth OAuth 2.1 and OIDC authentication flows.

Community
Advanced