github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6674] [MERGED] feat(phone-number): add password length validation for reset functionality #15061

New Issue
Closed
opened 2026-04-13 09:48:21 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:48:21 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6674
Author: @Bekacru
Created: 12/10/2025
Status: ✅ Merged
Merged: 12/13/2025
Merged by: @Bekacru

Base: canary ← Head: fix/phone-number-pass

📝 Commits (10+)

  • 7a943a7 feat(phone-number): add password length validation for reset functionality
  • ab1e0cf add fixes
  • 74d8429 add delete verificaiton value
  • 974d37b use logger
  • 537a7ba dont skip cookie check
  • c7da195 fix state
  • 188b95a feat(phone-number): implement session revocation after password reset and enhance tests
  • ad3b3cc feat(one-time-token): add session expiration check and corresponding test
  • 25b2ad7 fix types
  • 28febd9 feat(two-factor): enhance backup codes test and restrict client access to viewBackupCodes

📊 Changes

18 files changed (+222 additions, -35 deletions)

View changed files

📝 docs/content/docs/plugins/mcp.mdx (+4 -0)
📝 docs/content/docs/plugins/phone-number.mdx (+4 -0)
📝 packages/better-auth/src/oauth2/state.ts (+24 -7)
📝 packages/better-auth/src/plugins/jwt/types.ts (+1 -1)
📝 packages/better-auth/src/plugins/jwt/verify.ts (+1 -0)
📝 packages/better-auth/src/plugins/one-time-token/index.ts (+7 -0)
📝 packages/better-auth/src/plugins/one-time-token/one-time-token.test.ts (+40 -0)
📝 packages/better-auth/src/plugins/phone-number/phone-number.test.ts (+83 -0)
📝 packages/better-auth/src/plugins/phone-number/routes.ts (+23 -5)
📝 packages/better-auth/src/plugins/two-factor/two-factor.test.ts (+27 -12)
📝 packages/better-auth/src/social.test.ts (+1 -0)
📝 packages/core/src/social-providers/figma.ts (+1 -1)
📝 packages/core/src/social-providers/notion.ts (+1 -1)
📝 packages/core/src/social-providers/tiktok.ts (+1 -2)
📝 packages/core/src/social-providers/vk.ts (+1 -2)
📝 packages/expo/src/client.ts (+1 -1)
📝 packages/passkey/src/routes.ts (+2 -1)
📝 packages/stripe/src/routes.ts (+0 -2)

📄 Description

Summary by cubic

Enforces password length rules in phone-number password reset, revokes sessions on reset when enabled, and validates JWT audience with a baseURL default and multi-audience support.
Strengthens OAuth2 state checks, rejects one-time tokens on expired sessions, blocks user enumeration in phone-number reset requests, restricts client access to two-factor backup codes, tightens passkey and Stripe restore flows, and marks social provider emails unverified.

Written for commit 5668e5ec2b. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6674 **Author:** [@Bekacru](https://github.com/Bekacru) **Created:** 12/10/2025 **Status:** ✅ Merged **Merged:** 12/13/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `fix/phone-number-pass` --- ### 📝 Commits (10+) - [`7a943a7`](https://github.com/better-auth/better-auth/commit/7a943a7032819301636b301577849a26baad5760) feat(phone-number): add password length validation for reset functionality - [`ab1e0cf`](https://github.com/better-auth/better-auth/commit/ab1e0cfa8cd0b505a8b31400760d41273bdc1dfc) add fixes - [`74d8429`](https://github.com/better-auth/better-auth/commit/74d842998b53d82c6388c18b5342a3f4832cab89) add delete verificaiton value - [`974d37b`](https://github.com/better-auth/better-auth/commit/974d37b981a55d45d92c80efe4af1a2fa47ed4c8) use logger - [`537a7ba`](https://github.com/better-auth/better-auth/commit/537a7ba05aac5381b36878cb1608884447ff3c72) dont skip cookie check - [`c7da195`](https://github.com/better-auth/better-auth/commit/c7da1950fd2e059ecfbe48046396ac71ff5611eb) fix state - [`188b95a`](https://github.com/better-auth/better-auth/commit/188b95ab2d414d7ecfdd5c69a553397ca55782a9) feat(phone-number): implement session revocation after password reset and enhance tests - [`ad3b3cc`](https://github.com/better-auth/better-auth/commit/ad3b3cc1ad679aca1543802a3992515944a0958d) feat(one-time-token): add session expiration check and corresponding test - [`25b2ad7`](https://github.com/better-auth/better-auth/commit/25b2ad7f7ae6f0c19edd38f3b687678fbfdcee68) fix types - [`28febd9`](https://github.com/better-auth/better-auth/commit/28febd9c2f0cd007f0aabdd4b5d766a5fa5fe763) feat(two-factor): enhance backup codes test and restrict client access to viewBackupCodes ### 📊 Changes **18 files changed** (+222 additions, -35 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/mcp.mdx` (+4 -0) 📝 `docs/content/docs/plugins/phone-number.mdx` (+4 -0) 📝 `packages/better-auth/src/oauth2/state.ts` (+24 -7) 📝 `packages/better-auth/src/plugins/jwt/types.ts` (+1 -1) 📝 `packages/better-auth/src/plugins/jwt/verify.ts` (+1 -0) 📝 `packages/better-auth/src/plugins/one-time-token/index.ts` (+7 -0) 📝 `packages/better-auth/src/plugins/one-time-token/one-time-token.test.ts` (+40 -0) 📝 `packages/better-auth/src/plugins/phone-number/phone-number.test.ts` (+83 -0) 📝 `packages/better-auth/src/plugins/phone-number/routes.ts` (+23 -5) 📝 `packages/better-auth/src/plugins/two-factor/two-factor.test.ts` (+27 -12) 📝 `packages/better-auth/src/social.test.ts` (+1 -0) 📝 `packages/core/src/social-providers/figma.ts` (+1 -1) 📝 `packages/core/src/social-providers/notion.ts` (+1 -1) 📝 `packages/core/src/social-providers/tiktok.ts` (+1 -2) 📝 `packages/core/src/social-providers/vk.ts` (+1 -2) 📝 `packages/expo/src/client.ts` (+1 -1) 📝 `packages/passkey/src/routes.ts` (+2 -1) 📝 `packages/stripe/src/routes.ts` (+0 -2) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Enforces password length rules in phone-number password reset, revokes sessions on reset when enabled, and validates JWT audience with a baseURL default and multi-audience support. Strengthens OAuth2 state checks, rejects one-time tokens on expired sessions, blocks user enumeration in phone-number reset requests, restricts client access to two-factor backup codes, tightens passkey and Stripe restore flows, and marks social provider emails unverified. <sup>Written for commit 5668e5ec2ba84104399c0a5dd37439a085656a88. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:48:21 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15061
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?