github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6934] [MERGED] feat: add auth.api.verifyPassword #15222

New Issue
Closed
opened 2026-04-13 09:53:52 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:53:52 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6934
Author: @SaviruFr
Created: 12/22/2025
Status: ✅ Merged
Merged: 1/2/2026
Merged by: @himself65

Base: canary ← Head: feat/password

📝 Commits (7)

  • fa2e9ec feat(password): verifyPassword endpoint
  • 9292c06 docs: add documentation for verifyPassword function
  • 42d4283 test: update openapi snapshot for verifyPassword
  • b172729 docs: update headers example
  • 3474566 docs: update setPassword examples
  • 635dd30 fix(password): pass error code directly
  • 324e352 fix: sort

📊 Changes

6 files changed (+303 additions, -3 deletions)

View changed files

📝 docs/content/docs/concepts/users-accounts.mdx (+19 -2)
📝 packages/better-auth/src/api/index.ts (+2 -0)
📝 packages/better-auth/src/api/routes/index.ts (+1 -1)
📝 packages/better-auth/src/api/routes/password.test.ts (+75 -0)
📝 packages/better-auth/src/api/routes/password.ts (+59 -0)
📝 packages/better-auth/src/plugins/open-api/__snapshots__/open-api.test.ts.snap (+147 -0)

📄 Description

clean version of #6667 ( previous one had messy git history :()
closes: #6657

Summary by cubic

Adds a verifyPassword endpoint to confirm a user's current password before sensitive actions. Exposes auth.api.verifyPassword, updates docs, and adds tests.

  • New Features
    • Added POST /verify-password (server-only) that requires a valid session via sensitiveSessionMiddleware.
    • Returns { status: true } on success; throws BAD_REQUEST "Invalid password" on mismatch.
    • Exported verifyPassword in api endpoints and routes.
    • Updated docs with usage example and guidance for OAuth users without passwords; added tests for success, wrong password, and missing session.

Written for commit 324e3522e8. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6934 **Author:** [@SaviruFr](https://github.com/SaviruFr) **Created:** 12/22/2025 **Status:** ✅ Merged **Merged:** 1/2/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/password` --- ### 📝 Commits (7) - [`fa2e9ec`](https://github.com/better-auth/better-auth/commit/fa2e9ec1880cc63c41126777c0522a08db802833) feat(password): verifyPassword endpoint - [`9292c06`](https://github.com/better-auth/better-auth/commit/9292c0602a366817d0dc49e2b37bf2e473720ac0) docs: add documentation for verifyPassword function - [`42d4283`](https://github.com/better-auth/better-auth/commit/42d428361eb53202a22b4322a2f2390bf04ff0d2) test: update openapi snapshot for verifyPassword - [`b172729`](https://github.com/better-auth/better-auth/commit/b17272987d1425f8de7da95acdd8b3f455e4f975) docs: update headers example - [`3474566`](https://github.com/better-auth/better-auth/commit/347456632d1bc37adb95b4acc652b2dc19fd767d) docs: update setPassword examples - [`635dd30`](https://github.com/better-auth/better-auth/commit/635dd30f1d1193051edc308e4ebb668da9a36bfb) fix(password): pass error code directly - [`324e352`](https://github.com/better-auth/better-auth/commit/324e3522e815f93db7e94e5b87b32860afa08626) fix: sort ### 📊 Changes **6 files changed** (+303 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/concepts/users-accounts.mdx` (+19 -2) 📝 `packages/better-auth/src/api/index.ts` (+2 -0) 📝 `packages/better-auth/src/api/routes/index.ts` (+1 -1) 📝 `packages/better-auth/src/api/routes/password.test.ts` (+75 -0) 📝 `packages/better-auth/src/api/routes/password.ts` (+59 -0) 📝 `packages/better-auth/src/plugins/open-api/__snapshots__/open-api.test.ts.snap` (+147 -0) </details> ### 📄 Description clean version of #6667 ( previous one had messy git history :() closes: #6657 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds a verifyPassword endpoint to confirm a user's current password before sensitive actions. Exposes auth.api.verifyPassword, updates docs, and adds tests. - **New Features** - Added POST /verify-password (server-only) that requires a valid session via sensitiveSessionMiddleware. - Returns { status: true } on success; throws BAD_REQUEST "Invalid password" on mismatch. - Exported verifyPassword in api endpoints and routes. - Updated docs with usage example and guidance for OAuth users without passwords; added tests for success, wrong password, and missing session. <sup>Written for commit 324e3522e815f93db7e94e5b87b32860afa08626. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:53:52 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15222
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?