What problem does it solve? Hardening a Better Auth deployment requires coordinating many security settings—secrets, rate limits, CSRF checks, cookies, OAuth token encryption, and audit logging—and misconfiguring any one of them leaves authentication endpoints exposed to brute force, CSRF, or account enumeration attacks. ## Core Features & Use Cases - Rate Limiting & Brute Force Defense: Configure global and per-endpoint rate limits with memory, database, or Redis-backed storage, including stricter rules for sign-in and sign-up endpoints. - Session, Cookie & CSRF Hardening: Set session expiration, encrypted cookie caches (compact, JWT, or JWE), secure cookie attributes, cross-subdomain cookies, and multi-layer CSRF protection with trusted origins including wildcard and dynamic patterns. - OAuth & Audit Security: Encrypt stored OAuth tokens with AES-256-GCM, configure state strategies, track client IPs, and implement audit logging via database hooks for sessions, users, and linked accounts. - Use Case: Before launching a production app, apply the complete security configuration example and run through the deployment checklist to verify secrets, HTTPS, trusted origins, and rate limits are all correctly set. ## Quick Start Review my Better Auth configuration and apply production security best practices including rate limiting, trusted origins, and encrypted sessions.
