What problem does it solve?
This Skill helps you prevent account takeover and session abuse by hardening a Better Auth deployment against brute force, CSRF, malicious redirects, insecure cookies, and weak token handling.
Core Features & Use Cases
- Secure secret management: Use strong secrets via config or environment variables, reject placeholder secrets, and avoid committing secrets to version control.
- Brute-force resistance with rate limiting: Enable production-safe rate limiting with configurable storage and per-endpoint custom rules for sensitive auth routes.
- CSRF protection and origin hardening: Keep CSRF checks enabled and restrict requests using trusted origin validation, including support for wildcard and dynamic trusted origins.
- Session and cookie security: Configure secure session lifetimes, choose safe cookie caching strategies, and enforce secure cookie attributes with optional cross-subdomain sharing.
- OAuth/social provider security: Ensure safe state handling, optionally encrypt OAuth tokens, and apply best practices for mobile flows.
- Attack visibility via auditing: Add database hooks to record security-relevant events like session creation/revocation and email changes.
Quick Start
Use the better-auth-security-best-practices skill to generate a complete Better Auth configuration that enables rate limiting, keeps CSRF protection on, sets trusted origins, hardens sessions/cookies, encrypts OAuth tokens, and adds audit logging.
