better-auth-security-best-practices
Configure rate limiting, manage auth secrets, set up CSRF protection
by better-authFree
Description
better-auth-security-best-practices is an agent skill from the better-auth skills collection that guides a coding agent through securing an authentication setup built with Better Auth. It covers the security settings a Better Auth project usually needs: configuring rate limiting, managing the auth secret, setting up CSRF protection, defining trusted origins, securing sessions and cookies, encrypting OAuth tokens, and tracking IP addresses. The skill's secret management section explains where Better Auth looks for its secret. It checks the secret option in your config first, then the BETTER_AUTH_SECRET environment variable, then AUTH_SECRET, and it sets out the requirements the secret must meet. The skill is meant to be used while an agent is writing or reviewing auth code, so the agent follows the library's recommended settings instead of defaults it might guess. It is listed on skills.sh, where the page shows install counts, the repository's GitHub stars and the results of its security audits.…
Highlights
- Rate limiting for auth endpoints
- Auth secret management and lookup order
- CSRF protection and trusted origins
- Secure sessions, cookies and encrypted OAuth tokens
- Install from skills.sh
Ratings & Reviews
No ratings yet
Be the first to rate better-auth-security-best-practices.
People also visit
better-auth-security-best-practices FAQ
What does this skill cover?
Rate limiting, managing the auth secret, CSRF protection, trusted origins, secure sessions and cookies, encrypting OAuth tokens, and tracking IP addresses in a Better Auth setup.
Where does Better Auth read its secret?
The skill says it checks the secret option in your config first, then the BETTER_AUTH_SECRET environment variable, then AUTH_SECRET.
How do I install it?
Run npx skills add https://github.com/better-auth/skills --skill better-auth-security-best-practices.
What are the security audit results?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
How popular is it?
The page shows about 45.7K installs, and the better-auth/skills repository has 222 GitHub stars.
When should an agent use it?
When it is writing or reviewing authentication code for a Better Auth project, so it applies the library's recommended security settings.
What are the best better-auth-security-best-practices alternatives?
Popular alternatives to better-auth-security-best-practices include email-and-password-best-practices, secure-code-guardian and quarkus-security. See all better-auth-security-best-practices alternatives