技能 configuring-better-auth

📦

configuring-better-auth

Name: configuring-better-auth
Author: Asmayaseen

内容修订 r2 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

配置 Better Auth OAuth 和 OIDC SSO

OAuth/OIDC 设置在身份验证服务器、客户端、令牌存储和重定向之间容易出错。此技能会指导使用 PKCE、JWKS、刷新、登出和电子邮件验证模式来设置 Better Auth 服务器和 Next.js SSO 客户端。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "configuring-better-auth" from https://skillstore.io/skills/asmayaseen-configuring-better-auth.md and its manifest at https://skillstore.io/api/skills/asmayaseen-configuring-better-auth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/asmayaseen-configuring-better-auth.md 已签名 manifest GET /api/skills/asmayaseen-configuring-better-auth/manifest 已签名 lockfile GET /api/skills/asmayaseen-configuring-better-auth/lockfile

测试它

正在使用“configuring-better-auth”。我需要为三个内部 Next.js 应用提供 SSO。

预期结果:

推荐的身份验证服务器和客户端架构。
基于 PKCE 的客户端注册计划。
用于重定向 URI、令牌过期、JWKS 和登出的检查清单。

正在使用“configuring-better-auth”。我的 OAuth 回调可以工作，但令牌过期后刷新失败。

预期结果:

需要在刷新路由中检查的可能原因。
Cookie 和刷新令牌处理检查。
可实现的更安全的服务器端刷新流程。

正在使用“configuring-better-auth”。在生产前审查此 Better Auth 设置。

预期结果:

按令牌存储、重定向、PKCE、JWKS 和电子邮件验证分组的安全发现。
针对每个风险模式的具体修复步骤。
最终部署就绪检查清单。

安全审计

高风险

v9 • 2026/7/23 打开版本化报告

Static results were dominated by false positives from Markdown, template literals, normal environment configuration, and expected OAuth network operations. Three findings remain confirmed: two remote MCP trust-boundary references and disabled signing-key encryption. Semantic review found serious flaws in token storage, state validation, JWT validation, redirects, cookies, and route protection.

已扫描文件

1,526

分析行数

复核项

已忽略误报

已确认安全问题 (8)

高

references/auth-server-setup.md:439

Crypto seed/private key mention

disablePrivateKeyEncryption: true, // Disable encryption for simplicity

The example explicitly disables private-key encryption for signing keys. A database or storage compromise could therefore expose usable OIDC signing material.

高

references/sso-client-integration.md:80-84 references/sso-client-integration.md:125-141

OAuth State Is Not Validated

The client stores state, but the callback never compares the returned value with the stored value. This enables login CSRF.

State generation and callback parsing are present, but no equality check appears before token exchange.

高

references/sso-client-integration.md:234-237 references/sso-client-integration.md:437-440

JWT Issuer And Audience Checks Are Missing

JWT verification pins RS256 but omits issuer and audience checks in session and proxy paths. Tokens for another client could be accepted.

Both jwtVerify calls provide only an algorithm allowlist, while the main skill demonstrates the missing audience option.

高

references/auth-server-setup.md:133-157 references/auth-server-setup.md:526-529

Bearer Tokens Are Stored In Local Storage

The auth-server guide stores access and refresh tokens in localStorage and explicitly recommends that pattern. Same-origin scripts can read those bearer credentials.

The guide directly reads and removes bearer tokens from localStorage, then states clients should only use that storage.

高

references/sso-client-integration.md:446-457

Static Asset Rule Can Bypass Authentication

The proxy treats every pathname containing a period as a static asset. Protected routes with periods can bypass authentication.

The unconditional pathname.includes check returns before token validation and is not limited to known asset directories or extensions.

中

references/sso-client-integration.md:173-175 references/sso-client-integration.md:498-523

Post-Authentication Redirects Are Not Restricted

Callback and refresh redirects accept cookie or query values without enforcing a local path. Absolute URLs can redirect users to attacker-controlled sites.

The URL constructor accepts absolute URLs, and neither redirect source is checked against an allowlist or same-origin policy.

中

SKILL.md:130-146 references/sso-client-integration.md:315-327

PKCE Verifier Cookies Are Script Readable

The examples write PKCE verifiers through document.cookie without Secure or HttpOnly protection. Same-origin scripts can steal an active verifier.

Both examples create the verifier cookie in browser JavaScript, making HttpOnly impossible and leaving Secure unset.

中

SKILL.md:171-177

Quick-Start Token Cookies Lack Security Attributes

The main quick-start sets token cookies with only httpOnly. Missing Secure, SameSite, path, and lifetime controls weakens production token protection.

The cookie setters visibly omit attributes that the longer client guide later includes.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

低

SKILL.md:19

Hardcoded URL

claude mcp add --transport http better-auth https://mcp.chonkie.ai/better-auth/better-auth-builder/m

The skill directs Claude to a third-party remote MCP endpoint. Prompts and project context may cross that trust boundary without a local privacy review.

低

SKILL.md:29

Hardcoded URL

"url": "https://mcp.chonkie.ai/better-auth/better-auth-builder/mcp"

The settings example connects Claude to a third-party remote MCP endpoint. Prompts and project context may cross that trust boundary without a local privacy review.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (50)

📁 文件系统访问 (3)

references/auth-server-setup.md:266 references/auth-server-setup.md:557 SKILL.md:238

🔑 环境变量 (50)

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/asmayaseen-configuring-better-auth/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-configuring-better-auth/security.svg)](https://skillstore.io/skills/asmayaseen-configuring-better-auth?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/asmayaseen-configuring-better-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-configuring-better-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/asmayaseen-configuring-better-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

Asmayaseen. (2026). configuring-better-auth security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-configuring-better-auth/audits/9

BibTeX 引用

@techreport{asmayaseen-asmayaseen-configuring-better-auth-2026,
  author = {Asmayaseen},
  title = {configuring-better-auth security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-configuring-better-auth/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "configuring-better-auth security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-configuring-better-auth/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-configuring-better-auth:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

规划共享身份验证服务器

为多个应用设计 Better Auth 服务器，包含 OIDC、PKCE、客户端注册和同意决策。

为 Next.js 应用添加 SSO

为 Next.js 客户端应用实现登录、回调、会话、刷新和登出路由。

审查 OAuth 安全缺口

在生产前检查重定向 URI 处理、令牌存储、JWKS 验证、刷新流程和登出行为。

试试这些提示

创建设置计划

Use this skill to plan a Better Auth OAuth/OIDC setup for two Next.js apps. Ask for missing architecture details first.

配置身份验证服务器

Use this skill to outline the Better Auth OIDC provider configuration, PKCE client settings, JWKS setup, and email verification choices.

集成 SSO 客户端

Use this skill to design the Next.js SSO client routes for login, callback, session, token refresh, and global logout.

审计现有流程

Use this skill to review an existing Better Auth SSO flow for token storage, state validation, redirect handling, JWKS verification, and logout gaps.

最佳实践

对公共客户端使用 PKCE，并避免在浏览器代码中保留客户端密钥。
尽可能将 bearer tokens 存储在 httpOnly、Secure、SameSite Cookie 中。
在信任令牌之前，验证 state、重定向 URI、issuer、audience 和 JWKS 签名。

避免

不要在生产应用中将 access 或 refresh tokens 存储在 localStorage 中。
不要在回调路由中跳过 OAuth state 验证。
不要在没有明确的信任审查前添加第三方 MCP 服务器。

常见问题

此技能帮助配置什么？

它有助于使用 PKCE 和 JWKS 模式配置 Better Auth OAuth/OIDC 服务器和 Next.js SSO 客户端。

它会创建完整的生产系统吗？

不会。它提供实现指导和示例，仍然需要针对项目进行审查和测试。

它能帮助处理令牌刷新吗？

可以。它描述服务器端刷新路由、Cookie 处理和常见故障点。

它支持 Claude、Codex 和 Claude Code 吗？

支持。报告标明支持 Claude、Codex 和 Claude Code。

是否必须使用 Better Auth MCP 服务器？

不需要。MCP 服务器是可选的，只应在信任审查后添加。

团队在生产前应审查什么？

审查令牌存储、state 验证、重定向处理、JWKS 密钥保护、电子邮件发送和登出行为。

开发者详情

作者

Asmayaseen

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/Asmayaseen/hackathon-2/tree/main/.claude/skills/configuring-better-auth

引用

89edfdc710d0846129dcee6a929477b04f08052c

维护新鲜度

2026/7/27

使用量

8 次下载 · 478 次浏览

文件结构

📁 references/

📄 auth-server-setup.md

📄 sso-client-integration.md

📁 scripts/

📄 verify.py

优化 React 和 Next.js 性能

由 vercel-labs

React 和 Next.js 应用常常会因为瀑布式请求、大型包体以及可避免的重复渲染而变慢。此技能为代理提供具体规则，以便更安全地进行以性能为重点的改动。

编码与开发查看

configuring-better-auth

使用我的智能体安装

Agent 可读资源

测试它

安全审计

已确认安全问题 (8)

风险因素

复制报告链接

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 评分

你能构建什么

规划共享身份验证服务器

为 Next.js 应用添加 SSO

审查 OAuth 安全缺口

试试这些提示

最佳实践

避免

常见问题

开发者详情

Asmayaseen 的更多技能

tool-design

systematic-debugging

operating-production-services

styling-with-shadcn

streaming-llm-responses

context-degradation

相关技能

senior-fullstack

vercel-react-view-transitions

senior-frontend

nextjs-architecture

nextjs-optimization

vercel-react-best-practices