start-core-auth-server-primitives

Store an opaque session token in an HttpOnly, Secure, SameSite=Lax cookie with the __Host- prefix, then load it in createMiddleware so every protected server function receives a typed session. Read the cookie inside .handler() or middleware .server(), never at module scope.

Attach an auth middleware to every server function that touches private data, because route guards with beforeLoad do not protect RPCs called directly. The middleware validates the session token and throws Unauthorized before the handler runs.

No, a beforeLoad redirect on an _authenticated layout only affects page navigation. Server functions remain reachable via direct POST requests, so auth must be enforced inside the handler or through middleware on each function.

Generate a random state and PKCE verifier, store both in a short-lived signed HttpOnly cookie, and redirect to the provider with the S256 code challenge. In the callback, verify the returned state matches the cookie before exchanging the code with the verifier.

Module-level code runs before any request exists, so request headers and cookies are unavailable. On edge runtimes like Cloudflare Workers, environment variables are also injected per-request, making module-scope reads evaluate to undefined.

Return the same 200 response and identical body whether or not the email exists, and perform equivalent work in both branches to avoid timing leaks. Never use different messages or status codes that reveal account existence.