skills.rest
lukevella
lukevellaCOMMUNITY
Explore all skills by this author →
Website𝕏@imlukevellaGitHub

email-and-password-best-practices

Configure secure email and password authentication with Better Auth.

5.2k|543|Updated Jan 27, 2015
Search Tags:#better-auth#token-management#security-best-practices#password-security#email-authentication#verification-email
One-click install
npx skills add https://github.com/lukevella/rallly --skill email-and-password-best-practices-lukevella
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/lukevella/rallly/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/lukevella/rallly --skill email-and-password-best-practices-lukevella

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.

Core Features & Use Cases

  • Email verification setup to verify user email addresses during sign-up.
  • Enforcement of email verification with requireEmailVerification to block sign-ins for unverified accounts.
  • Password reset flows including sending reset emails and handling tokens securely.
  • Token security and session management, including token expiration and optional session revocation on password reset.
  • Password hashing options with default scrypt and support for custom hash/verify implementations.
  • Redirect URL validation to prevent open redirects and ensure trusted origins are used.

Quick Start

Enable Better Auth with email/password, configure email verification, and set up a secure password reset flow.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure email verification during user sign-up?▼

Secure email verification during sign-up is implemented by configuring Better Auth to send verification emails and enforcing requirements with requireEmailVerification to block sign-ins for unverified accounts.

What is the best way to handle password reset tokens securely?▼

Handling password reset tokens securely involves configuring Better Auth to send reset emails, manage token expiration, validate redirect URLs to prevent open redirects, and optionally revoke sessions on password reset.

Can I use a custom password hashing algorithm instead of the default scrypt?▼

Yes, you can use custom password hashing algorithms instead of the default scrypt by providing your own custom hash and verify implementations within the Better Auth configuration.

How do I prevent open redirects when configuring password reset URLs?▼

Preventing open redirects requires validating redirect URLs during password resets to ensure only trusted origins are used, a configuration enforced by this authentication guidance.

Does Better Auth support automatic session revocation after a password reset?▼

Yes, Better Auth supports optional session revocation on password reset, allowing you to invalidate active sessions when a user successfully resets their password.

Related Skills

Explore More Software Engineering Skills→
devkit-stackdevkit-stack

create-auth-skill

Configure Better Auth authentication for TypeScript/JavaScript applications.

Official
Intermediate
Sir-chawakornSir-chawakorn
9

auth-jwt-session

Implement JWT issuance, verification, and OAuth2/OIDC authentication workflows.

Community
Advanced
rennerenne

smtp-configuration

Configure SMTP email delivery in Vaultwarden using environment variables and security protocols.

Community
Intermediate
damien-schneiderdamien-schneider
32

convex-setup-auth

Configure authentication and identity management for Convex applications.

Community
Advanced