github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6454] [MERGED] feat(admin): prevent impersonating admins by default [breaking] #14923

New Issue
Closed
opened 2026-04-13 09:42:17 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:42:17 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6454
Author: @jslno
Created: 12/1/2025
Status: ✅ Merged
Merged: 12/9/2025
Merged by: @Bekacru

Base: canary ← Head: 12-01-2025/prevent-admin-impersonation

📝 Commits (10+)

  • 1252cd9 feat: prevent impersonating admins
  • 02117da chore: add test
  • cd5dae7 chore: allow to opt-out
  • bbbba31 fix: handle admin roles array properly
  • 574276c fix: handle comma separated lists
  • 29dd6fb chore: fix linting
  • 5e10d59 chore: update docs
  • fca359c chore: resolve conflicts
  • f225383 Merge branch 'canary' into 12-01-2025/prevent-admin-impersonation
  • 23182f1 fix: types

📊 Changes

5 files changed (+63 additions, -2 deletions)

View changed files

📝 docs/content/docs/plugins/admin.mdx (+10 -0)
📝 packages/better-auth/src/plugins/admin/admin.test.ts (+24 -0)
📝 packages/better-auth/src/plugins/admin/error-codes.ts (+1 -0)
📝 packages/better-auth/src/plugins/admin/routes.ts (+22 -2)
📝 packages/better-auth/src/plugins/admin/types.ts (+6 -0)

📄 Description

closes #6448

Summary by cubic

Prevent impersonation of admin accounts in the admin plugin to close a security gap. Impersonation requests targeting admins (by role or adminUserIds, with defaultRole fallback) now return FORBIDDEN unless allowImpersonatingAdmins is true, with support for array and comma-separated adminRoles.

Written for commit f2abdb4174. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6454 **Author:** [@jslno](https://github.com/jslno) **Created:** 12/1/2025 **Status:** ✅ Merged **Merged:** 12/9/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `12-01-2025/prevent-admin-impersonation` --- ### 📝 Commits (10+) - [`1252cd9`](https://github.com/better-auth/better-auth/commit/1252cd91b805adda9e8d4716dd9009cf91cda48d) feat: prevent impersonating admins - [`02117da`](https://github.com/better-auth/better-auth/commit/02117da3954aa2c876b6936a8450ff9d6b32a4ca) chore: add test - [`cd5dae7`](https://github.com/better-auth/better-auth/commit/cd5dae73dc8eaade6576e48b505dbb78957e4a14) chore: allow to opt-out - [`bbbba31`](https://github.com/better-auth/better-auth/commit/bbbba31d6cf96b617acdddecf620dc69b75cdde8) fix: handle admin roles array properly - [`574276c`](https://github.com/better-auth/better-auth/commit/574276cabf9920e8ac000954efd8f9214f568bb7) fix: handle comma separated lists - [`29dd6fb`](https://github.com/better-auth/better-auth/commit/29dd6fb6a4951005339e1ed086fc834e0862a965) chore: fix linting - [`5e10d59`](https://github.com/better-auth/better-auth/commit/5e10d59478423c34d8932d49de47580e13c96be8) chore: update docs - [`fca359c`](https://github.com/better-auth/better-auth/commit/fca359c8a6f0cd8e4d035801b579c4df1c1cdee4) chore: resolve conflicts - [`f225383`](https://github.com/better-auth/better-auth/commit/f22538325f78e089200e598f3dbd1578c4b9122c) Merge branch 'canary' into 12-01-2025/prevent-admin-impersonation - [`23182f1`](https://github.com/better-auth/better-auth/commit/23182f1fe37e90231efae7f56d24b6252d37c226) fix: types ### 📊 Changes **5 files changed** (+63 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/admin.mdx` (+10 -0) 📝 `packages/better-auth/src/plugins/admin/admin.test.ts` (+24 -0) 📝 `packages/better-auth/src/plugins/admin/error-codes.ts` (+1 -0) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+22 -2) 📝 `packages/better-auth/src/plugins/admin/types.ts` (+6 -0) </details> ### 📄 Description closes #6448 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Prevent impersonation of admin accounts in the admin plugin to close a security gap. Impersonation requests targeting admins (by role or adminUserIds, with defaultRole fallback) now return FORBIDDEN unless allowImpersonatingAdmins is true, with support for array and comma-separated adminRoles. <sup>Written for commit f2abdb4174a735392880d7dc8c7d25946a989703. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:42:17 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#14923
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?