github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Banned user is not redirected to website after login with social account #1037

New Issue
Closed
opened 2026-03-13 08:19:55 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 08:19:55 -05:00
Owner
Copy Link

Originally created by @brunocalou on GitHub (Apr 13, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Ban an user
  2. Try to login as the banned user with a social account (e.g. Google)
  3. The user will see a raw json response

Current vs. Expected behavior

Current: The user sees a raw json response from server
Expected: The user should be redirected to the website with an error query param

https://github.com/user-attachments/assets/7bf106e1-930f-42e7-9fcd-0b9f4b0fbc61

What version of Better Auth are you using?

1.2.6

Provide environment information

- OS: Mac 15.3.1 (24D70)
- Browser: Brave Version 1.77.95 Chromium: 135.0.7049.52 (Official version) (arm64)

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from 'better-auth';
import { drizzleAdapter } from 'better-auth/adapters/drizzle';
import { db } from './db/db';
import { admin, captcha, username } from 'better-auth/plugins';
import * as authSchema from './db/schema/auth';

export const auth = betterAuth({
	basePath: '/auth',
	trustedOrigins: [

	],
	advanced: {
		crossSubDomainCookies: {
			enabled: true,
			domain: process.env.BETTER_AUTH_COOKIE_DOMAIN,
		},
		defaultCookieAttributes: {
			secure: true,
			httpOnly: true,
			sameSite: "none",  // Allows CORS-based cookie sharing across subdomains
			partitioned: true, // New browser standards will mandate this for foreign cookies
		},
		useSecureCookies: process.env.NODE_ENV === "production"
	},
	database: drizzleAdapter(db, {
		provider: 'pg',
		schema: authSchema,
	}),
	emailVerification: {
		sendVerificationEmail: async ({ user, url }) => {
			console.log(url);
		},
		sendOnSignUp: true,
		autoSignInAfterVerification: true,
		expiresIn: 3600 // 1 hour
	},
	emailAndPassword: {
		enabled: true,
		requireEmailVerification: true,
		sendResetPassword: async ({ user, url }) => {
			console.log(url);
		},
	},
	socialProviders: {
		google: {
			clientId: process.env.GOOGLE_CLIENT_ID as string,
			clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
		},
	},
	account: {
		accountLinking: {
			enabled: true,
			trustedProviders: ['google'],
		},
	},
	plugins: [
		username({
			minUsernameLength: 3,
			maxUsernameLength: 20,
		}),
		admin(),
		captcha({
			provider: 'cloudflare-turnstile', // or "google-recaptcha"
			secretKey: process.env.TURNSTILE_SECRET_KEY!,
		}),
	],
});

Additional context

No response

Originally created by @brunocalou on GitHub (Apr 13, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Ban an user 2. Try to login as the banned user with a social account (e.g. Google) 3. The user will see a raw json response ### Current vs. Expected behavior Current: The user sees a raw json response from server Expected: The user should be redirected to the website with an error query param https://github.com/user-attachments/assets/7bf106e1-930f-42e7-9fcd-0b9f4b0fbc61 ### What version of Better Auth are you using? 1.2.6 ### Provide environment information ```bash - OS: Mac 15.3.1 (24D70) - Browser: Brave Version 1.77.95 Chromium: 135.0.7049.52 (Official version) (arm64) ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from 'better-auth'; import { drizzleAdapter } from 'better-auth/adapters/drizzle'; import { db } from './db/db'; import { admin, captcha, username } from 'better-auth/plugins'; import * as authSchema from './db/schema/auth'; export const auth = betterAuth({ basePath: '/auth', trustedOrigins: [ ], advanced: { crossSubDomainCookies: { enabled: true, domain: process.env.BETTER_AUTH_COOKIE_DOMAIN, }, defaultCookieAttributes: { secure: true, httpOnly: true, sameSite: "none", // Allows CORS-based cookie sharing across subdomains partitioned: true, // New browser standards will mandate this for foreign cookies }, useSecureCookies: process.env.NODE_ENV === "production" }, database: drizzleAdapter(db, { provider: 'pg', schema: authSchema, }), emailVerification: { sendVerificationEmail: async ({ user, url }) => { console.log(url); }, sendOnSignUp: true, autoSignInAfterVerification: true, expiresIn: 3600 // 1 hour }, emailAndPassword: { enabled: true, requireEmailVerification: true, sendResetPassword: async ({ user, url }) => { console.log(url); }, }, socialProviders: { google: { clientId: process.env.GOOGLE_CLIENT_ID as string, clientSecret: process.env.GOOGLE_CLIENT_SECRET as string, }, }, account: { accountLinking: { enabled: true, trustedProviders: ['google'], }, }, plugins: [ username({ minUsernameLength: 3, maxUsernameLength: 20, }), admin(), captcha({ provider: 'cloudflare-turnstile', // or "google-recaptcha" secretKey: process.env.TURNSTILE_SECRET_KEY!, }), ], }); ``` ### Additional context _No response_
GiteaMirror added the bug label 2026-03-13 08:19:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1037
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?