Better Auth 实现指南：Next.js 安全认证、OAuth 集成与双因素认证

Implementing Better Auth by doanchienthangdev/omgkit

3 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/doanchienthangdev/omgkit --skill 'Implementing Better Auth'

Node.js API 安全

🇨🇳中文介绍

实现 Better Auth

快速开始

// lib/auth.ts
import { betterAuth } from "better-auth";
import { prismaAdapter } from "better-auth/adapters/prisma";

export const auth = betterAuth({
  database: prismaAdapter(prisma, { provider: "postgresql" }),
  emailAndPassword: { enabled: true, requireEmailVerification: true },
  session: { expiresIn: 60 * 60 * 24 * 7 },
  socialProviders: {
    google: { clientId: process.env.GOOGLE_CLIENT_ID!, clientSecret: process.env.GOOGLE_CLIENT_SECRET! },
  },
});

功能特性

功能	描述	参考链接
邮箱/密码认证	安全的注册、登录、密码验证	认证指南
社交 OAuth	Google、GitHub、Discord 提供商集成	社交提供商
双因素认证	基于 TOTP 的多因素认证，附带备用代码

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

FlyClaw：零登录航班聚合查询工具，Python实现多源航班信息与价格搜索

4,000,000 周安装

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

117,000 周安装

OpenClaw 安全 Linux 云部署指南：私有优先、SSH隧道、Podman容器化

31,600 周安装

Linux云主机安全托管指南：从SSH加固到HTTPS部署

31,600 周安装

// lib/auth-client.ts
import { createAuthClient } from "better-auth/client";
import { twoFactorClient, organizationClient } from "better-auth/client/plugins";

export const authClient = createAuthClient({
  baseURL: process.env.NEXT_PUBLIC_API_URL,
  plugins: [twoFactorClient(), organizationClient()],
});

export const { signIn, signUp, signOut, useSession } = authClient;

// middleware.ts
import { auth } from "@/lib/auth";
import { NextRequest, NextResponse } from "next/server";

export async function middleware(request: NextRequest) {
  const session = await auth.api.getSession({ headers: request.headers });

  if (!session && !request.nextUrl.pathname.startsWith("/login")) {
    return NextResponse.redirect(new URL("/login", request.url));
  }
  return NextResponse.next();
}

// 处理登录时的 2FA
const { data, error } = await authClient.signIn.email({ email, password });

if (error?.code === "TWO_FACTOR_REQUIRED") {
  // 显示 2FA 输入框
  const { data: verified } = await authClient.twoFactor.verify({ code: totpCode });
}

// 为用户启用 2FA
const { data } = await authClient.twoFactor.enable();
// data.totpURI 包含二维码数据
// data.backupCodes 包含恢复代码

建议做法	避免做法
新账户要求邮箱验证	存储明文密码
在认证端点启用速率限制	暴露详细的错误信息
使用 HttpOnly、Secure Cookie	使用可预测的会话令牌
设置强密码要求（12+ 字符）	允许无限次登录尝试
实现适当的会话过期机制	在 JWT 中存储敏感数据
记录认证事件以供审计	跳过 CSRF 保护

🇺🇸English

Implementing Better Auth

Quick Start

// lib/auth.ts
import { betterAuth } from "better-auth";
import { prismaAdapter } from "better-auth/adapters/prisma";

export const auth = betterAuth({
  database: prismaAdapter(prisma, { provider: "postgresql" }),
  emailAndPassword: { enabled: true, requireEmailVerification: true },
  session: { expiresIn: 60 * 60 * 24 * 7 },
  socialProviders: {
    google: { clientId: process.env.GOOGLE_CLIENT_ID!, clientSecret: process.env.GOOGLE_CLIENT_SECRET! },
  },
});

Features

Feature	Description	Reference
Email/Password Auth	Secure registration, login, password validation	Auth Guide
Social OAuth	Google, GitHub, Discord provider integration	Social Providers
Two-Factor Auth	TOTP-based MFA with backup codes	2FA Plugin
Session Management	Secure cookie-based sessions with refresh	Sessions
Rate Limiting	Configurable limits per endpoint	Rate Limiting
Organizations	Multi-tenant support with roles	Organizations Plugin

Common Patterns

Client Setup with Plugins

// lib/auth-client.ts
import { createAuthClient } from "better-auth/client";
import { twoFactorClient, organizationClient } from "better-auth/client/plugins";

export const authClient = createAuthClient({
  baseURL: process.env.NEXT_PUBLIC_API_URL,
  plugins: [twoFactorClient(), organizationClient()],
});

export const { signIn, signUp, signOut, useSession } = authClient;

Protected Routes Middleware

// middleware.ts
import { auth } from "@/lib/auth";
import { NextRequest, NextResponse } from "next/server";

export async function middleware(request: NextRequest) {
  const session = await auth.api.getSession({ headers: request.headers });

  if (!session && !request.nextUrl.pathname.startsWith("/login")) {
    return NextResponse.redirect(new URL("/login", request.url));
  }
  return NextResponse.next();
}

Two-Factor Authentication Flow

// Handle 2FA during sign-in
const { data, error } = await authClient.signIn.email({ email, password });

if (error?.code === "TWO_FACTOR_REQUIRED") {
  // Show 2FA input
  const { data: verified } = await authClient.twoFactor.verify({ code: totpCode });
}

// Enable 2FA for user
const { data } = await authClient.twoFactor.enable();
// data.totpURI contains QR code data
// data.backupCodes contains recovery codes

Best Practices

Do	Avoid
Require email verification for new accounts	Storing plain-text passwords
Enable rate limiting on auth endpoints	Exposing detailed error messages
Use httpOnly, secure cookies	Using predictable session tokens
Set strong password requirements (12+ chars)	Allowing unlimited login attempts
Implement proper session expiration	Storing sensitive data in JWT
Log authentication events for auditing	Skipping CSRF protection

References

Weekly Installs

Repository

doanchienthangdev/omgkit

GitHub Stars

First Seen

Jan 1, 1970

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Better Auth 实现指南：Next.js 安全认证、OAuth 集成与双因素认证

🇨🇳中文介绍

实现 Better Auth

快速开始

功能特性

相关 Skills

常用模式

客户端设置（含插件）

受保护路由中间件

双因素认证流程

最佳实践

参考资源