What problem does it solve?
Better Auth deployments are vulnerable when secrets, session handling, CSRF protections, and request throttling are misconfigured, leading to brute-force login attempts, token/session exposure, and hard-to-audit security incidents.
Core Features & Use Cases
- Secret Management: Configure strong Better Auth secrets via config or environment variables, and enforce requirements like minimum length and entropy to reduce guessing risk.
- Rate Limiting: Enable protection against high-rate abuse globally and tailor stricter limits for sensitive auth endpoints such as sign-in and password/email changes.
- CSRF and Origin Hardening: Keep CSRF checks enabled and define trusted origins (including wildcard patterns and dynamic validation) to prevent cross-site request forgery and unauthorized redirects.
- Session and Cookie Security: Set safe session expiration/update policies and use secure cookie defaults (HTTPS-only, httpOnly, sameSite, and prefixing) to limit session theft and misuse.
- OAuth Token Protection and Auditing: Encrypt OAuth tokens, implement database hooks for audit logging, and use generic error messaging to reduce account enumeration.
- Operational Safety: Configure background task handling for serverless platforms and optionally track IPs for rate limiting when behind proxies.
Quick Start
Update your Better Auth configuration to use an environment-provided secret, enable rate limiting, keep CSRF checks on, and set trustedOrigins to your frontend/admin origins.
