Tanstack start auth
Skill MakFly/superpowers-tanstack-start/skills/tanstack-start-auth
Open-source Claude Code plugin and Agent Skills for TanStack Start: type-safe routing, server functions, SSR, middleware, authentication, testing, and deployment.
npx -y skills add MakFly/superpowers-tanstack-start --skill tanstack-start-authAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 27 days oldThe repository was created 27 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Design, implement, audit, or debug authentication and authorization in TanStack Start. Use for sessions, cookies, login, logout, OAuth state and PKCE, password reset, CSRF, rate limiting, protected routes, RBAC, tenant isolation, secret handling, or auth tests.
SKILL.md
1.7 KB, as published. Nobody here has run it
TanStack Start Authentication
Define the trust boundary
Read ../../docs/authentication-and-security.md. Identify the principal, credential, session store, protected resource, tenant boundary, and every callable endpoint.
Protect the data endpoint
Authenticate and authorize inside every server function or server route that accesses protected data. Use beforeLoad only for navigation behavior and early UX.
Implement secure primitives
- Resolve sessions per request.
- Use secure, HTTP-only, appropriately scoped cookies.
- Rotate sessions after authentication or privilege changes.
- Invalidate sessions on logout.
- Use generic credential and reset responses that resist account enumeration.
- Use OAuth
stateand PKCE and bind callbacks to the initiating session. - Protect cookie-authenticated mutations from CSRF.
- Rate-limit sensitive endpoints.
- Validate secrets and configuration without exposing values.
Do not invent custom cryptography or password hashing.
Verify adversarial cases
Test anonymous access, invalid credentials, expired and revoked sessions, CSRF failure, replayed OAuth state, password-reset reuse, horizontal access between users or tenants, insufficient roles, and rate-limit behavior.
Return findings by severity with exact endpoint and file references. Distinguish confirmed vulnerabilities from hardening suggestions.