two-factor-authentication-best-practices

Malicious tool definition detected

### Client-Side Setup Add the client plugin and configure the redirect behavior for 2FA verification: ```ts import { createAuthClient } from "better-auth/client"; import { twoFactorClient } from "better-auth/client/plugins"; export const authClient = createAuthClient({ plugins: [ twoFactorClient({ onTwoFactorRedirect() { window.location.href = "/2fa"; // Redirect to your 2FA verification page }, }), ], }); ``` ## Enabling 2FA for Users When a user enables 2FA, require their password for verifica

Session cookie is created upon successful verification Configure the two-factor cookie expiration: ```ts twoFactor({ twoFactorCookieMaxAge: 600, // 10 minutes in seconds (default) }); ``` ### Rate Limiting Better Auth applies built-in rate limiting to all 2FA endpoints (3 requests per 10 seconds).