Skip to the content

/

Better Auth

Better Auth 1.7

Better Auth: 0% done

Module 1 · Who you are, and what you may do

An app with private things has to know who is asking

Loading the slide…

A line of words about as long as a slide’s first line, and its second.

Another line, shorter.

1 / 170 · Who you are, and what you may do

Course progress

0%

An app with private things has to know who is asking
, 1 to practiseAuthentication is who you are; authorization is what you may do
, 1 to practiseCredentials prove who you are
One person, one user, several ways in
, 1 to practiseThe journeys every app with accounts needs
Why use a library instead of writing it yourself
, 1 to practiseChecks that matter happen on the server
Recap: who and what

The web is requests and responses
What a request and a response look like
, 1 to practiseEach request starts from nothing
A cookie is a value the browser sends back for you
, 1 to practiseCookie settings decide who can see and send it
An origin is scheme, host and port
, 1 to practiseSameSite decides what other sites can trigger
See it for yourself
Recap: HTTP and cookies

A session is a coat-check ticket
, 1 to practiseThe token must be long and random
, 1 to practiseA signature proves the server made it
A self-contained token carries its own proof
, 1 to practiseLooking it up costs a read; not looking it up costs control
Sessions expire, and use can extend them
, 1 to practiseWhere the browser keeps it matters
Better Auth's default: database sessions in a signed cookie
Recap: sessions and tokens

, 1 to practiseNever keep the password itself
A hash is a one-way fingerprint
, 1 to practiseHashing is not encryption
, 1 to practiseA salt makes every hash unique
, 1 to practisePassword hashes are slow on purpose
Length beats complexity rules
, 1 to practiseChecking a password without giving anything away
Recap: passwords

Attackers go after the weakest step
, 1 to practisePhishing: a convincing fake
, 1 to practiseCredential stuffing and brute force: guessing at scale
Enumeration: do not say who has an account
CSRF: another site sends your request
, 1 to practiseXSS: the attacker's script on your page
, 1 to practiseSession theft: copying the key
Where each defence comes in this course
Recap: attacks

What you need before the first line
, 1 to practiseA secret and a base URL, from the environment
One file configures it
, 1 to practiseFour tables: user, session, account, verification
The command-line tool creates the tables
, 1 to practiseWith an ORM, the tables are part of your schema
, 1 to practiseTwo ways in: the handler and auth.api
Recap: installing

Hono is a small web server framework
One route hands everything under /api/auth to Better Auth
The endpoints it serves
, 1 to practiseTry it with curl
, 1 to practiseYour routes ask auth.api who is signed in
Better Auth checks where requests come from
, 1 to practisePages on another origin need CORS
, 1 to practiseWhen nothing answers, check the path
Recap: serving with Hono

The client is a typed wrapper around the endpoints
, 1 to practiseEvery call answers with data or an error
A sign-in form, from top to bottom
, 1 to practiseWho is signed in, and signing out
, 1 to practiseIn React, useSession keeps the page up to date
Callbacks for loading states and redirects
, 1 to practiseReading an error
Recap: the client

The options that matter
What sign-up does inside
, 1 to practiseSign-up that doesn't say who has an account
Sign-in, and what comes back
, 1 to practiseCalling it from the server, and catching refusals
, 1 to practiseBringing your own password hash
, 1 to practiseChanging a password signs other devices out
Recap: email and password

An emailed link proves you can read the inbox
Sending the confirmation email
, 1 to practiseSend without making the answer wait
, 1 to practiseRequire it, or gate what it unlocks
, 1 to practiseChoosing a new password, end to end
, 1 to practiseAfter a reset, assume the old password was known
, 1 to practiseMagic links: sign in by email alone
Treat a link's token like a password
Recap: emailed links

getSession checks the cookie, the row and the clock
, 1 to practiseexpiresIn and updateAge make a sliding window
, 1 to practiseA refreshed session comes with a new cookie
A fresh session for dangerous actions
, 1 to practiseA "where you are signed in" page
, 1 to practiseThe session cookie, as Better Auth sets it
, 1 to practiseThe cookie cache trades revocation for speed
Recap: sessions

OAuth lets another service vouch for someone
The authorization code flow, end to end
Register the app with the provider first
, 1 to practisesocialProviders, and a button that starts it
, 1 to practiseState and PKCE close two different holes
, 1 to practiseOne user, one account per way in
, 1 to practiseLinking on first sign-in, only with verified emails
Linking on purpose, while signed in
Recap: social sign-in

A middleware puts the user on the context
requireUser: only signed-in people get through
, 1 to practiseAuthorization: check the row is theirs
, 1 to practiseYour own routes need their own CSRF check
Roles name what groups of people may do
, 1 to practiseWhat an admin can do
, 1 to practisePermissions of your own
Recap: protecting routes

A plugin adds endpoints, tables and behaviour
, 1 to practiseAdding a plugin is a small migration
Two-factor sign-in with an authenticator app
, 1 to practiseSigning in with a second factor
, 1 to practiseBackup codes are passwords too
Passkeys: sign-in that cannot be phished
, 1 to practiseOrganizations: shared notebooks for teams
Recap: plugins

Three ways to add your own behaviour
A before hook can refuse a request
, 1 to practisePractice: close sign-in for suspended emails
, 1 to practiseAn after hook reacts to what happened
, 1 to practisedatabaseHooks run around writes
, 1 to practiseExtra fields on the user
Turning endpoints off
Recap: hooks and fields

Defence in layers, cheapest first
Better Auth's rate limiter
, 1 to practiseCounts must be shared by every server
, 1 to practiseKnow which IP you are limiting
, 1 to practiseLockouts can be turned against the account
, 1 to practiseA captcha checks a person is there
, 1 to practiseRefuse passwords that are already leaked
Recap: rate limits and bots

Test the flows, not the library
An auth instance just for tests
Drive the real endpoints with requests
, 1 to practiseCarry the cookie to the next request
, 1 to practiseCatch emailed links and follow them
The test-utils plugin skips the busywork
, 1 to practiseTest the refusals hardest
Recap: testing

, 1 to practisePin the session cookie to one host
, 1 to practiseTrusted origins guard redirects and requests
Secrets: strong, separate, rotatable
Plan for the database leaking
The cookie cache, weighed properly
, 1 to practiseDeciding whether to cache
Security headers on every reply
Before going live
Recap: hardening

Three ways to lay out pages and server
, 1 to practiseSharing a session across subdomains
, 1 to practiseDifferent sites: avoid third-party cookies
An audit log records security events
, 1 to practiseWriting audit entries from hooks
, 1 to practiseSigns of an attack
, 1 to practiseWhen something goes wrong, contain first
, 1 to practiseMatching the response to the incident
Recap: production

How to use this module
, 1 to practiseReview: a configuration with one dangerous line
, 1 to practiseReview: a route that updates a note
, 1 to practiseTrace: Sign in with GitHub, from click to cookie
, 1 to practisePredict: sessions over a week
, 1 to practiseBuild: a protected route that keeps sessions alive
, 1 to practiseDesign: an invite-only notes app for one company
, 1 to practiseRespond: a takeover report
Your final project
Recap: what an expert keeps in mind