email-and-password-best-practices

Secure email verification in Better Auth requires configuring verification hooks to prevent fake sign-ups and ensure users own their registered emails. This skill provides enforcement guidance to satisfy production requirements for configured verification workflows.

Password reset best practices involve configuring token expiration, validating redirects, and optionally revoking active sessions upon reset. This skill enforces security-focused defaults to protect authentication systems from account takeover attempts.

Email and password authentication prevents takeovers by enforcing strong password policies, secure token expiration, and mandatory email verification. This skill applies safe defaults and session control rules to harden production web and mobile backends.

Yes, these password security policies apply to both web and mobile backends using Better Auth. The skill provides enforcement guidance for token security, session control, and verification suitable for production mobile authentication systems.

Revoking sessions on password reset is an optional but recommended security measure. This skill provides configurable guidance for session revocation alongside token expiration and redirect validation to maintain secure session control.

Production authentication systems require secure token expiration and redirect validation configurations. This skill enforces these token security requirements along with safe defaults to satisfy production-grade email and password authentication standards.