github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[BUG] accountLinking options are ignored #1361

New Issue
Closed
opened 2026-03-13 08:34:55 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 08:34:55 -05:00
Owner
Copy Link

Originally created by @Crea7orX on GitHub (Jun 15, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Set account.accountLinking.enabled: false and attempt to link a Google account.
  2. Set account.accountLinking.allowDifferentEmails: false and attempt to link a Google account with a different email address.

Current vs. Expected behavior

When creating an authentication instance with accountLinking options, these configurations are being ignored, leading to unexpected behavior:

1. Disabling Account Linking:

  • Expected Behavior: When account.accountLinking.enabled is set to false, the user should not be allowed to link their account to external services (e.g., Google).
  • Current Behavior: Despite setting account.accountLinking.enabled = false, the user can still link their Google account by calling await authClient.linkAccount("google"), which is incorrect.

2. Email Mismatch in Account Linking:

  • Expected Behavior: When account.accountLinking.allowDifferentEmails is set to false, users should not be able to link their Google account to a profile with a different email address.
  • Current Behavior: The current implementation allows users to link their Google account to a profile with a different email address, which is incorrect. This flag (allowDifferentEmails) is enforced by the generic-oauth plugin, but should be enforced everywhere.

What version of Better Auth are you using?

1.2.9

Provide environment information

- OS: Windows 11
- Browser: Firefox

Which area(s) are affected? (Select all that apply)

Backend, Documentation

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
  socialProviders: {
    google: {
      clientId: env.GOOGLE_CLIENT_ID,
      clientSecret: env.GOOGLE_CLIENT_SECRET,
    },
    github: {
      clientId: env.GITHUB_CLIENT_ID,
      clientSecret: env.GITHUB_CLIENT_SECRET,
    },
  },
  account: {
    accountLinking: {
      enabled: false,
      allowDifferentEmails: false,
    },
  },
});

Additional context

Both issues suggest that the accountLinking options are not being properly respected or enforced in the authentication flow.

Originally created by @Crea7orX on GitHub (Jun 15, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Set `account.accountLinking.enabled: false` and attempt to link a Google account. 2. Set `account.accountLinking.allowDifferentEmails: false` and attempt to link a Google account with a different email address. ### Current vs. Expected behavior When creating an authentication instance with `accountLinking` options, these configurations are being ignored, leading to unexpected behavior: ### 1. Disabling Account Linking: - **Expected Behavior**: When `account.accountLinking.enabled` is set to `false`, the user should not be allowed to link their account to external services (e.g., Google). - **Current Behavior**: Despite setting `account.accountLinking.enabled = false`, the user can still link their Google account by calling `await authClient.linkAccount("google")`, which is incorrect. ### 2. Email Mismatch in Account Linking: - **Expected Behavior**: When `account.accountLinking.allowDifferentEmails` is set to `false`, users should not be able to link their Google account to a profile with a different email address. - **Current Behavior**: The current implementation allows users to link their Google account to a profile with a different email address, which is incorrect. This flag (`allowDifferentEmails`) is enforced by the **generic-oauth** plugin, but should be enforced everywhere. ### What version of Better Auth are you using? 1.2.9 ### Provide environment information ```bash - OS: Windows 11 - Browser: Firefox ``` ### Which area(s) are affected? (Select all that apply) Backend, Documentation ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, socialProviders: { google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET, }, github: { clientId: env.GITHUB_CLIENT_ID, clientSecret: env.GITHUB_CLIENT_SECRET, }, }, account: { accountLinking: { enabled: false, allowDifferentEmails: false, }, }, }); ``` ### Additional context Both issues suggest that the `accountLinking` options are not being properly respected or enforced in the authentication flow.
GiteaMirror added the bug label 2026-03-13 08:34:55 -05:00
GiteaMirror commented 2026-03-13 08:34:56 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Aug 1, 2025):

from #3739, you can see all test passes and works as intended. closing this issue now. if you think that is not the case , make sure to tag me here.

@Kinfe123 commented on GitHub (Aug 1, 2025): from #3739, you can see all test passes and works as intended. closing this issue now. if you think that is not the case , make sure to tag me here.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1361
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?