What problem does it solve? Implementing email and password authentication involves many security-sensitive decisions—email verification, password reset flows, token handling, and hashing algorithms—where mistakes lead to account takeover, timing attacks, or open redirect vulnerabilities. This Skill provides concrete Better Auth configuration patterns that enforce security best practices. ## Core Features & Use Cases - Email Verification Setup: Configure sendVerificationEmail and optionally require verification before sign-in to block fake accounts. - Secure Password Reset Flows: Implement reset emails with timing-attack prevention, single-use expiring tokens, session revocation, and redirect URL validation against trusted origins. - Password Hashing Guidance: Use the default scrypt hashing or plug in Argon2id via custom hash and verify functions with recommended parameters. - Use Case: When adding email/password sign-in to a Better Auth application, apply these patterns to ensure reset tokens expire, sessions are revoked on password change, and callback URLs use absolute origins. ## Quick Start Apply the email and password best practices to configure Better Auth with email verification and a secure password reset flow in my project.
