Better Auth Best Practices

Review Better Auth integrations for secure defaults, configuration quality, and production-readiness without taking over full implementation.

Standards snapshot (March 2026)

• Use Better Auth’s current docs as the syntax source of truth, but keep repo-local findings grounded in the actual integration.
• Audit the real risk surfaces first: secrets, session handling, account linking, CSRF and origin checks, provider configuration, and plugin sprawl.
• Align review output to OWASP Top 10:2025, especially auth, session, and access-control risks.
• Prefer the smallest safe change set over broad auth redesign advice.

Philosophy

• Review the real integration, not an imagined ideal architecture.
• Prioritize findings that materially reduce auth and session risk.
• Prefer small, testable remediations over broad rewrites.

When to use

• Auditing an existing Better Auth setup for security gaps.
• Reviewing configuration choices, plugins, providers, or session behavior.
• Debugging auth flows, cookie/session handling, or deployment hardening.