start-auth

原文涵盖的主题

• TanStack Start — Authentication
• CRITICAL GOTCHA (READ BEFORE ANYTHING)
• Agent Workflow (MANDATORY)
• Overview
• Critical Rules
• Auth Approaches (official)
• Reference Guide
• Concepts

Covers authentication and authorization in TanStack Start: protecting routes with beforeLoad + redirect, authorizing server functions via middleware (the actual security boundary), session/cookie handling (useSession, getRequest, Host- cookies), CSRF protection (createCsrfMiddleware + Origin checks), and wiring managed providers like Auth.js, Better Auth, Clerk, or WorkOS. The central gotcha this skill exists to prevent: beforeLoad + redirect() protects the UI only — server functions and server routes are independently reachable API endpoints, so authorization MUST be enforced inside the server-function handler or its middleware, never assumed from a route guard. Ships DIY server-primitive templates (portable, no vendor lock-in) for an authed layout + authMiddleware, session/CSRF helpers, and OAuth authorization-code flow with PKCE. For a managed auth library, install it and follow its own current docs or the dedicated better-auth skill rather than assuming a Start adapter API. Do NOT use this skill for generic route guards unrelated to auth (react-tanstack-router) or non-Start Node auth setups. beforeLoad + redirect() protects the UI, NOT your data. Server functions and server rou

这里只展示节选，请以完整原文和当前要求为准。