github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-23 17:58:47 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Following documentation can lead to security breaches #1345

New Issue
Closed
opened 2026-03-13 08:34:08 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 08:34:08 -05:00
Owner
Copy Link
Copy Source

Originally created by @phbernard on GitHub (Jun 11, 2025).

TL;DR When adding a field to users with additionalFields, it is important to consider input: false. Else, you might have a security issue. The docs are incomplete or even misleading in this respect.

Better auth docs explain how to add fields to users. In the example, we add a role field, which is quite classic:

additionalFields: {
  role: {
      type: "string"
    } 
}

This is exactly the use case I wanted to implement, so I gladly reproduced it.

Now, every time I have a user, I have its role, too:

console.log(`User ${user.email} has role ${user.role}`);

Another place where the role show up is at registration. I have to pass a role to signUp.email:

await authClient.signUp.email({
  email,
  password,
  name,
  role: UserRole.Default, // And certainly not UserRole.Admin
});

Looking at the request payload, I can see the role field is present. It is thus easy for someone to play with this field until he finds an interesting value - like Admin.

From a TypeScript point of view, I can make the role attribute optional with required: false. Now I don't have to reveal the role field to my users:

await authClient.signUp.email({
  email,
  password,
  name,
  // ... and role has a default value of UserRole.Default in the database
});

But the field still exists, and can be added to the payload of a forged request.

My advices:

PS: If you need roles, you might want to consider https://www.better-auth.com/docs/plugins/admin

Originally created by @phbernard on GitHub (Jun 11, 2025). TL;DR When adding a field to users with `additionalFields`, it is important to consider `input: false`. Else, you might have a security issue. The docs are incomplete or even misleading in this respect. Better auth docs explain how to [add fields to users](https://www.better-auth.com/docs/concepts/typescript#additional-fields). In the example, we add a `role` field, which is quite classic: ``` additionalFields: { role: { type: "string" } } ``` This is exactly the use case I wanted to implement, so I gladly reproduced it. Now, every time I have a user, I have its role, too: ``` console.log(`User ${user.email} has role ${user.role}`); ``` Another place where the role show up is at registration. I have to pass a role to `signUp.email`: ``` await authClient.signUp.email({ email, password, name, role: UserRole.Default, // And certainly not UserRole.Admin }); ``` Looking at the request payload, I can see the `role` field is present. It is thus easy for someone to play with this field until he finds an interesting value - like `Admin`. From a TypeScript point of view, I can make the `role` attribute optional with `required: false`. Now I don't have to reveal the `role` field to my users: ``` await authClient.signUp.email({ email, password, name, // ... and role has a default value of UserRole.Default in the database }); ``` But the field still exists, and can be added to the payload of a forged request. My advices: - Absolutely add `input: false` in the example at https://www.better-auth.com/docs/concepts/typescript#additional-fields - Add documentation about `input` at https://www.better-auth.com/docs/concepts/typescript (beyond the role example) - Set `input` to `false` by default. While this lowers the dev experience, it improves security, something an auth lib should do in my opinion. PS: If you need roles, you might want to consider https://www.better-auth.com/docs/plugins/admin
GiteaMirror added the securitydocumentation labels 2026-03-13 08:34:08 -05:00
GiteaMirror commented 2026-03-13 08:34:09 -05:00
Author
Owner
Copy Link
Copy Source

@dagmawibabi commented on GitHub (Jul 27, 2025):

Hey though the input isn't defaulting to false, the docs are better

@dagmawibabi commented on GitHub (Jul 27, 2025): Hey though the input isn't defaulting to false, the docs are better
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels documentation security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1345