agentsclimarketplace
Sign in

Tanstack start auth

Skill MakFly/superpowers-tanstack-start/skills/tanstack-start-auth

Design, implement, audit, or debug authentication and authorization in TanStack Start. Use for sessions, cookies, login, logout, OAuth state and PKCE, password reset, CSRF, rate limiting, protected routes, RBAC, tenant isolation, secret handling, or auth tests.From its SKILL.md

Install
npx -y skills add MakFly/superpowers-tanstack-start --skill tanstack-start-auth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, 240 tokens by cl100k_base, as published. Nobody here has run it

TanStack Start Authentication

Define the trust boundary

Read ../../docs/authentication-and-security.md. Identify the principal, credential, session store, protected resource, tenant boundary, and every callable endpoint.

Protect the data endpoint

Authenticate and authorize inside every server function or server route that accesses protected data. Use beforeLoad only for navigation behavior and early UX.

Implement secure primitives

  • Resolve sessions per request.
  • Use secure, HTTP-only, appropriately scoped cookies.
  • Rotate sessions after authentication or privilege changes.
  • Invalidate sessions on logout.
  • Use generic credential and reset responses that resist account enumeration.
  • Use OAuth state and PKCE and bind callbacks to the initiating session.
  • Protect cookie-authenticated mutations from CSRF.
  • Rate-limit sensitive endpoints.
  • Validate secrets and configuration without exposing values.

Do not invent custom cryptography or password hashing.

Verify adversarial cases

Test anonymous access, invalid credentials, expired and revoked sessions, CSRF failure, replayed OAuth state, password-reset reuse, horizontal access between users or tenants, insufficient roles, and rate-limit behavior.

Return findings by severity with exact endpoint and file references. Distinguish confirmed vulnerabilities from hardening suggestions.

What ships with it: 1 file

204 B alongside SKILL.md

agents/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.