email-and-password-best-practices

Secure email verification is implemented using Better Auth to ensure users own their emails. This skill guides you through configuring verification emails, callback URLs, and enforced on-sign-in re-verification to strengthen account security and prevent fake sign-ups.

The best way to set up password reset flows is by configuring customizable sendResetPassword handlers with token expiration and single-use tokens. This approach ensures reset tokens expire automatically and can only be used once, while also revoking existing sessions upon reset.

Yes, Better Auth works across serverless and Node environments for building authentication flows. It provides the necessary tools for email verification, password reset, token security, and session management within your serverless web applications.

Yes, Better Auth supports configurable password policies and safe password hashing by default using scrypt. You can also customize the hashing algorithm to Argon2id if your application requires a different cryptographic approach.

Timing attacks are prevented by implementing safe default messaging and security hardening rules. This skill provides guidance on mitigating timing attacks, validating redirect URLs, and revoking sessions on password resets to protect the authentication flow.