skills.rest
SeanChenR
SeanChenRCOMMUNITY
Explore all skills by this author →
GitHub

better-auth-security-best-practices

Configure rate limiting, CSRF protection, and audit logging for Better Auth.

Updated Aug 27, 2026
Search Tags:#security#authentication#rate limiting#oauth#session management#audit logging#csrf protection
One-click install
npx skills add https://github.com/SeanChenR/maestro-agent --skill better-auth-security-best-practices-seanchenr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: better-auth-security-best-practices
Source: https://github.com/SeanChenR/maestro-agent/tree/main/.agents/skills/better-auth-security-best-practices
Command: npx skills add https://github.com/SeanChenR/maestro-agent --skill better-auth-security-best-practices-seanchenr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a consolidated security configuration and operational checklist to protect Better Auth deployments from brute force attacks, credential leakage, CSRF exploits, session theft, and insufficient auditability.

Core Features & Use Cases

  • Configures and enforces strong secret management, rate limiting with customizable storage and per-endpoint rules, and multi-layer CSRF protection.
  • Secures sessions and cookies with strategies (compact, JWT, JWE), cross-subdomain options, and secure cookie attributes; adds OAuth protections such as PKCE, state handling, and optional token encryption.
  • Enables IP tracking, trusted origin validation, background task handling for serverless platforms, and database hook-based audit logging for compliance and incident investigation.
  • Use Case: Lock down a production API that handles sign-in, sign-up, password changes, and third-party OAuth by applying per-endpoint rate limits, enforcing trusted origins, encrypting tokens, and logging security-relevant events.

Quick Start

Configure Better Auth with a strong 32+ character secret, enable rate limiting and CSRF protection, set your trusted origins, and turn on audit hooks for session and account events.

Frequently Asked Questions about better-auth-security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure Better Auth against brute force and session theft?▼

Secure Better Auth by configuring strong 32+ character secrets, enabling per-endpoint rate limiting, applying multi-layer CSRF protection, and using secure cookie attributes to prevent brute force attacks and session theft.

Can I use Better Auth rate limiting with serverless platforms?▼

Yes, Better Auth rate limiting works with serverless platforms by configuring customizable storage options and enabling background task handling to manage rate-limit rules across serverless deployments.

What is the best way to protect OAuth tokens in Better Auth?▼

Protect OAuth tokens in Better Auth by enabling PKCE, enforcing state handling, and applying optional token encryption to secure third-party OAuth integrations against credential leakage.

How do I configure audit logging for Better Auth session events?▼

Configure database hook-based audit logging in Better Auth to track security-relevant session and account events, enabling compliance tracking and incident investigation for production web deployments.

Does Better Auth support JWE for session management?▼

Yes, Better Auth supports JWE for session management alongside compact and JWT strategies, allowing you to secure sessions and cookies with cross-subdomain options and trusted origin validation.

Why do I need trusted origin validation for multi-tenant Better Auth deployments?▼

Trusted origin validation is needed for multi-tenant Better Auth deployments to prevent CSRF exploits by ensuring only authorized cross-subdomain origins can interact with your authentication endpoints.

Related Skills

Explore More Software Engineering Skills→
powerhouse-incpowerhouse-inc

better-auth-best-practices

Provides configuration and best-practice guidance for Better Auth TypeScript authentication integration.

Official
Intermediate
heyu-aiheyu-ai

bash-hygiene-audit

Manage bash-hygiene hook audit logs and analyze violation rates.

Official
Advanced
z4nr34lz4nr34l

better-auth-best-practices

Guide Better Auth integration for TypeScript projects with security best practices.

Community
Intermediate
ali-masterali-master
8

orpc-better-auth

Integrate Better Auth authentication middleware into TypeScript oRPC services.

Community
Intermediate