github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #1085] Issue: Accumulation of Zombie Rows and Misplaced User Deletion Values #17217

New Issue
Closed
opened 2026-04-15 15:14:52 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-15 15:14:52 -05:00
Owner
Copy Link

Originally created by @JosipPardon on GitHub (Dec 31, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/1085

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I have simple email OTP sign in created using email OTP plugin, as described here.

User can click button for resending OTP, which does this:

const result = await authClient.emailOtp.sendVerificationOtp({  
   email,  
   type: "sign-in",  
});

If this button is pressed multiple times, unnecessary rows pile up in database:

image

These previous OTP's are useless, user can't sign in using them, so it does not make sense to keep them. They even stay in database after successful verification for that user.

Current vs. Expected behavior

When new row is added to verification table, all previous rows with same identifier should be deleted. This is also a security improvement because only one verification token or OTP will be available.

Additionally, after successful verification all rows associated with it should be cleared (both valid and invalid ones), just in case. Currently, only last row is deleted.

This does not apply only to email OTP, but to all things which use verification table (like user deletion).

Just little side note here. It seems that identifier and token are misplaced in rows associated with user deletion. User identifier is in value column, while deletion token is in identifier. Maybe this is intentional, but it is little bit strange. For email OTP situation is opposite:

image

Probably token and identifier should switch places in rows for user deletion.

What version of Better Auth are you using?

1.1.7

Provide environment information

Safari, MacOS

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

No response

Additional context

No response

Originally created by @JosipPardon on GitHub (Dec 31, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/1085 ### Is this suited for github? - [X] Yes, this is suited for github ### To Reproduce I have simple email OTP sign in created using email OTP plugin, as described [here](https://www.better-auth.com/docs/plugins/email-otp). User can click button for resending OTP, which does this: ```ts const result = await authClient.emailOtp.sendVerificationOtp({ email, type: "sign-in", }); ``` If this button is pressed multiple times, unnecessary rows pile up in database: <img width="519" alt="image" src="https://github.com/user-attachments/assets/1a885cd6-1cb0-4452-bf16-e2be605fa399" /> These previous OTP's are useless, user can't sign in using them, so it does not make sense to keep them. They even stay in database after successful verification for that user. ### Current vs. Expected behavior When new row is added to verification table, all previous rows with same identifier should be deleted. This is also a security improvement because only one verification token or OTP will be available. Additionally, after successful verification all rows associated with it should be cleared (both valid and invalid ones), just in case. Currently, only last row is deleted. This does not apply only to email OTP, but to all things which use verification table (like user deletion). *** Just little side note here. It seems that identifier and token are misplaced in rows associated with user deletion. User identifier is in _value_ column, while deletion token is in _identifier_. Maybe this is intentional, but it is little bit strange. For email OTP situation is opposite: <img width="737" alt="image" src="https://github.com/user-attachments/assets/d8a2b96a-8a66-4988-b289-446d4151b5a3" /> Probably token and identifier should switch places in rows for user deletion. ### What version of Better Auth are you using? 1.1.7 ### Provide environment information ```bash Safari, MacOS ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) _No response_ ### Additional context _No response_
GiteaMirror added the stalelockedbug labels 2026-04-15 15:14:52 -05:00
GiteaMirror commented 2026-04-15 15:14:54 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Jun 12, 2025):

Hi, @JosipPardon. I'm Dosu, and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale.

Issue Summary

  • Problem with email OTP plugin causing repeated OTP requests to create unnecessary database entries.
  • Suggestion to delete previous OTP entries upon generating a new one and clear all entries after successful verification.
  • Concern about incorrect placement of user identifiers and tokens in the database, affecting user deletion.
  • No further activity or comments have been made on the issue.

Next Steps

  • Is this issue still relevant to the latest version of the better-auth repository? If so, please comment to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 7 days.

Thank you for your understanding and contribution!

<!-- gh-comment-id:2967416343 --> @dosubot[bot] commented on GitHub (Jun 12, 2025): Hi, @JosipPardon. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog. I'm marking this issue as stale. **Issue Summary** - Problem with email OTP plugin causing repeated OTP requests to create unnecessary database entries. - Suggestion to delete previous OTP entries upon generating a new one and clear all entries after successful verification. - Concern about incorrect placement of user identifiers and tokens in the database, affecting user deletion. - No further activity or comments have been made on the issue. **Next Steps** - Is this issue still relevant to the latest version of the better-auth repository? If so, please comment to keep the discussion open. - Otherwise, this issue will be automatically closed in 7 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#17217
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?