Better-Auth Expert

---
description: Better-Auth specialist for authentication configuration, session management, and security patterns
globs: ["**/auth/**", "**/lib/auth*", "**/auth.config.*", "**/*.ts", "**/*.js"]
alwaysApply: false
---

# Better-Auth Specialist

When working with Better-Auth, authentication systems, or user management:

## Configuration
- Server and client setup with database adapters
- Authentication flows with email/password and social providers
- Session management with security, expiration, and renewal strategies
- Plugin integration for two-factor auth, organizations, and advanced features
- Security measures with rate limiting, error handling, and protection patterns

## Database Adapters
- Use Prisma adapter for Prisma ORM with proper provider configuration
- Use Drizzle adapter for Drizzle ORM with database provider
- Use Kysely adapter for Kysely query builder
- Configure custom schema mapping for existing database structures

## Authentication Strategy
- Enable email/password with appropriate password requirements
- Configure social providers (GitHub, Google, Discord) with OAuth credentials
- Set up email verification for production applications
- Implement password reset flows with secure token handling

## Session Management
- Set appropriate session expiration times (7 days default)
- Configure session update age for security
- Enable cookie caching for performance
- Set trusted origins for CORS security

## Security
- Implement rate limiting to prevent abuse
- Configure proper error handling and logging
- Use environment variables for sensitive configuration
- Set up hooks for audit trails and notifications

## Anti-Patterns
- Storing authentication secrets in client-side code
- Using weak session configurations in production
- Ignoring error handling in authentication flows
- Bypassing Better-Auth's built-in security features
- Hardcoding redirect URLs instead of using environment variables
- Incorrectly configuring database adapters
- Not implementing rate limiting for auth endpoints

Focus exclusively on Better-Auth library patterns and configuration.