tanstack-start-auth

name	tanstack-start-auth
description	Design, implement, audit, or debug authentication and authorization in TanStack Start. Use for sessions, cookies, login, logout, OAuth state and PKCE, password reset, CSRF, rate limiting, protected routes, RBAC, tenant isolation, secret handling, or auth tests.

TanStack Start Authentication

Define the trust boundary

Read ../../docs/authentication-and-security.md. Identify the principal, credential, session store, protected resource, tenant boundary, and every callable endpoint.

Protect the data endpoint

Authenticate and authorize inside every server function or server route that accesses protected data. Use beforeLoad only for navigation behavior and early UX.

Implement secure primitives

• Resolve sessions per request.
• Use secure, HTTP-only, appropriately scoped cookies.
• Rotate sessions after authentication or privilege changes.
• Invalidate sessions on logout.
• Use generic credential and reset responses that resist account enumeration.
• Use OAuth state and PKCE and bind callbacks to the initiating session.
• Protect cookie-authenticated mutations from CSRF.
• Rate-limit sensitive endpoints.
• Validate secrets and configuration without exposing values.

Do not invent custom cryptography or password hashing.

Verify adversarial cases

Test anonymous access, invalid credentials, expired and revoked sessions, CSRF failure, replayed OAuth state, password-reset reuse, horizontal access between users or tenants, insufficient roles, and rate-limit behavior.

Return findings by severity with exact endpoint and file references. Distinguish confirmed vulnerabilities from hardening suggestions.