From b046f9ec112b2cf547efea8dc870a4895602c53b Mon Sep 17 00:00:00 2001
From: Taesu <166604494+bytaesu@users.noreply.github.com>
Date: Wed, 24 Jun 2026 04:51:11 -0700
Subject: [PATCH] fix: apply rate limits before plugin requests (#10191)

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
---
 .changeset/twenty-pears-bake.md               |  5 ++
 packages/better-auth/src/api/index.ts         | 11 ++--
 .../src/plugins/captcha/captcha.test.ts       | 50 +++++++++++++++++++
 3 files changed, 61 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/twenty-pears-bake.md

diff --git a/.changeset/twenty-pears-bake.md b/.changeset/twenty-pears-bake.md
new file mode 100644
index 0000000000..f5d85387b0
--- /dev/null
+++ b/.changeset/twenty-pears-bake.md
@@ -0,0 +1,5 @@
+---
+"better-auth": patch
+---
+
+Rate limit client requests before plugin request handlers run.
diff --git a/packages/better-auth/src/api/index.ts b/packages/better-auth/src/api/index.ts
index 3e80c26173..153b15fa5b 100644
--- a/packages/better-auth/src/api/index.ts
+++ b/packages/better-auth/src/api/index.ts
@@ -301,6 +301,12 @@ export const router = <Option extends BetterAuthOptions>(
 			}
 
 			let currentRequest = req;
+
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) {
+				return rateLimitResponse;
+			}
+
 			for (const plugin of ctx.options.plugins || []) {
 				if (plugin.onRequest) {
 					const response = await withSpan(
@@ -320,11 +326,6 @@ export const router = <Option extends BetterAuthOptions>(
 				}
 			}
 
-			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
-			if (rateLimitResponse) {
-				return rateLimitResponse;
-			}
-
 			return currentRequest;
 		},
 		async onResponse(res, req) {
diff --git a/packages/better-auth/src/plugins/captcha/captcha.test.ts b/packages/better-auth/src/plugins/captcha/captcha.test.ts
index 07e8e88476..a4762baae1 100644
--- a/packages/better-auth/src/plugins/captcha/captcha.test.ts
+++ b/packages/better-auth/src/plugins/captcha/captcha.test.ts
@@ -91,6 +91,56 @@ describe("captcha", async () => {
 		expect(res.error?.status).toBe(400);
 	});
 
+	it("should apply rate limits before verifying captcha tokens", async () => {
+		mockBetterFetch.mockClear();
+		mockBetterFetch.mockResolvedValue({
+			data: {
+				success: false,
+				"error-codes": ["invalid-input-response"],
+			},
+		});
+		const { client, testUser } = await getTestInstance({
+			rateLimit: {
+				enabled: true,
+				customRules: {
+					"/sign-in/email": {
+						window: 10,
+						max: 1,
+					},
+				},
+			},
+			plugins: [
+				captcha({
+					provider: "cloudflare-turnstile",
+					secretKey: "xx-secret-key",
+				}),
+			],
+		});
+
+		const first = await client.signIn.email({
+			email: testUser.email,
+			password: testUser.password,
+			fetchOptions: {
+				headers: {
+					"x-captcha-response": "invalid-captcha-token",
+				},
+			},
+		});
+		const second = await client.signIn.email({
+			email: testUser.email,
+			password: testUser.password,
+			fetchOptions: {
+				headers: {
+					"x-captcha-response": "invalid-captcha-token",
+				},
+			},
+		});
+
+		expect(first.error?.status).toBe(403);
+		expect(second.error?.status).toBe(429);
+		expect(mockBetterFetch).toHaveBeenCalledTimes(1);
+	});
+
 	it("Should return 500 if an unexpected error occurs", async () => {
 		const { client } = await getTestInstance({
 			plugins: [