better-auth-security-best-practices

Secure authentication requires strict secret management, rate limiting, CSRF protection, and robust session handling. This Skill provides configuration examples for the Better Auth framework to implement these comprehensive security measures.

Prevent account enumeration and timing attacks by utilizing database hooks for auditing and executing authentication checks as background tasks. This ensures consistent response times and obscures valid user data from attackers.

Configure rate limiting and CSRF protection by applying framework-specific defense mechanisms against brute-force attacks and cross-site request forgery. This Skill details the exact configuration steps needed to secure authentication endpoints.

Yes, this guidance hardens OAuth integrations and social provider configurations. It provides specific examples to secure external authentication flows and leverages IP-based tracking to monitor and restrict malicious access attempts.

The best way to manage authentication secrets and session cookies is to enforce secure, strict configuration policies. This Skill outlines how to properly handle session data and manage secrets to maintain robust authentication security.