Agent skill · security · better-auth
better-auth-security-best-practices
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
Why this skill is useful
Provides specific configurations and practices for securing Better Auth deployments that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-07-11. 206 stars on the source repository.
What this skill does
Secret Management Configuring the Secret Better Auth looks for secrets in this order: 1. options.secret in your config 2. BETTERAUTHSECRET environment variable 3. AUTHSECRET environment variable Secret Requirements Rejects default/placeholder secrets in production Warns if shorter than 32 characters or entropy below 120 bits Generate: openssl rand -base64 32 Never commit secrets to version control Rate Limiting Enabled in production by default. Applies to all endpoints. Plugins can override per-endpoint. Default Configuration Storage Options Options: "memory" (resets on restart, avoid on serverless), "database" (persistent), "secondary-storage" (Redis, default when available). Custom Storage Implement your own rate limit storage: Per-Endpoint Rules Sensitive endpoints default to 3 requests per 10 seconds (/sign-in, /sign-up, /change-password, /change-email). Override: CSRF Protection Multi-layer protection: origin header validation, Fetch Metadata checks, and first-login protection. Configuration Only disable for testing or with an alternative CSRF mechanism. Trusted Origins Configuring Trusted Origins The baseURL origin is automatically trusted. Also configurable via env: BETTERAUTHTRUSTEDORIGINS=https://app.example.com,https://admin.example.com Wildcard Patterns Dynamic Trusted Origins Compute trusted origins based on the request: Validates callbackURL, redirectTo, errorCallbackURL, newUserCallbackURL, and origin against trusted origins. Invalid URLs receive 403. Session Security Session Expiration Session Caching Strategies Cache session data in cookies to reduce database queries: Strategies: "compact" (Base64url + HMAC, smallest), "jwt" (HS256, standard), "jwe" (encrypted, use when session has sensitive data). Cookie Security Defaults: secure: true (HTTPS/production), sameSite: "lax", httpOnly: true, path: "/", prefix Secure-. Custom Cookie Configuration Cross-Subdomain Cookies Only enable if you need authentication sharing and trust all subdomains. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills better-auth/security