github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #3848] Add rateLimit Configuration Option to emailOTP Plugin #18371

New Issue
Closed
opened 2026-04-15 16:49:43 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-15 16:49:43 -05:00
Owner
Copy Link

Originally created by @issam-seghir on GitHub (Aug 7, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/3848

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Add a rateLimit configuration option to the emailOTP plugin , similar to the existing implementation in the maginLink plugin. This would allow developers to easily override the default rate limiting settings for all emailOTP endpoints from within the plugin configuration.

Current Behavior

  emailOTP({
            async sendVerificationOTP({ email, otp, type }, request) {
                await sendVerificationRequest({
                    identifier: email,
                    token:otp,
                    request: request,
                    expires: new Date(Date.now() + ms("5m")),
                });
            },
            expiresIn: ms("5m") / 1000, // 5 minutes (in seconds)
            allowedAttempts: 3,
            otpLength: 6,
          // ⚠️ No rateLimit option available
        }),

To customize rate limits for emailOTP endpoints, we must manually configure each endpoint in the global customRules :

rateLimit: {
    enabled: true,
    window: 60,
    max: 100,
    storage: "secondary-storage",
    customRules: {
        "/email-otp/send-verification-otp": {
            window: 60,
            max: 3,
        },
        "/sign-in/email-otp": {
            window: 60,
            max: 5,
        },
        "/email-otp/verify-email": {
            window: 60,
            max: 10,
        },
        // Need to manually add each emailOTP endpoint...
    },
}

but i think ite really handy and usefull to ovvride ratelimit in plugin config as magic link pluigin allow it wil ovrrider rate limit for all endpoints of the plugin instead of ovirede each endpoint manully in customRules

Describe the solution you'd like

Desired Behavior

The emailOTP plugin should accept a rateLimit configuration option that applies to all plugin endpoints, just like the magicLink plugin:

emailOTP({
    async sendVerificationOTP({ email, otp, type }, request) {
        await sendVerificationRequest({
            identifier: email,
            token: otp,
            request: request,
            expires: new Date(Date.now() + ms("5m")),
        });
    },
    expiresIn: ms("5m") / 1000,
    allowedAttempts: 3,
    otpLength: 6,
    rateLimit: {  
        window: 60, // 1 minute
        max: 3,     // 3 requests per minute
    },
})

This feature is particularly valuable when migrating from magicLink to emailOTP authentication, as it maintains the same configuration pattern and allows for consistent rate limiting policies across the application's authentication flow.

Describe alternatives you've considered

..

Additional context

No response

Originally created by @issam-seghir on GitHub (Aug 7, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/3848 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Add a **rateLimit** configuration option to the **emailOTP** plugin , similar to the existing implementation in the **maginLink** plugin. This would allow developers to easily override the default rate limiting settings for all emailOTP endpoints from within the plugin configuration. ## Current Behavior ```ts emailOTP({ async sendVerificationOTP({ email, otp, type }, request) { await sendVerificationRequest({ identifier: email, token:otp, request: request, expires: new Date(Date.now() + ms("5m")), }); }, expiresIn: ms("5m") / 1000, // 5 minutes (in seconds) allowedAttempts: 3, otpLength: 6, // ⚠️ No rateLimit option available }), ``` To customize rate limits for emailOTP endpoints, we must manually configure each endpoint in the global `customRules` : ```ts rateLimit: { enabled: true, window: 60, max: 100, storage: "secondary-storage", customRules: { "/email-otp/send-verification-otp": { window: 60, max: 3, }, "/sign-in/email-otp": { window: 60, max: 5, }, "/email-otp/verify-email": { window: 60, max: 10, }, // Need to manually add each emailOTP endpoint... }, } ``` but i think ite really handy and usefull to ovvride ratelimit in plugin config as magic link pluigin allow it wil ovrrider rate limit for all endpoints of the plugin instead of ovirede each endpoint manully in customRules ### Describe the solution you'd like ## Desired Behavior The `emailOTP` plugin should accept a `rateLimit` configuration option that applies to all plugin endpoints, just like the `magicLink` plugin: ```ts emailOTP({ async sendVerificationOTP({ email, otp, type }, request) { await sendVerificationRequest({ identifier: email, token: otp, request: request, expires: new Date(Date.now() + ms("5m")), }); }, expiresIn: ms("5m") / 1000, allowedAttempts: 3, otpLength: 6, rateLimit: { window: 60, // 1 minute max: 3, // 3 requests per minute }, }) ``` This feature is particularly valuable when migrating from magicLink to emailOTP authentication, as it maintains the same configuration pattern and allows for consistent rate limiting policies across the application's authentication flow. ### Describe alternatives you've considered .. ### Additional context _No response_
GiteaMirror added the lockedenhancement labels 2026-04-15 16:49:43 -05:00
GiteaMirror commented 2026-04-15 16:49:45 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 6, 2025):

Hi, @issam-seghir. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested a rateLimit configuration option for the emailOTP plugin, similar to the existing one in the magicLink plugin.
  • This feature would allow overriding default rate limits for all emailOTP endpoints within the plugin config.
  • The goal is to simplify setup by avoiding manual rate limit rules for each endpoint in global customRules.
  • There has been no further activity or discussion on this request since it was opened.

Next Steps:

  • Please let me know if this feature is still relevant to the latest version of better-auth by commenting on this issue.
  • If I do not hear back within 7 days, I will automatically close this issue.

Thanks for your understanding and contribution!

<!-- gh-comment-id:3498170741 --> @dosubot[bot] commented on GitHub (Nov 6, 2025): Hi, @issam-seghir. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested a `rateLimit` configuration option for the `emailOTP` plugin, similar to the existing one in the `magicLink` plugin. - This feature would allow overriding default rate limits for all `emailOTP` endpoints within the plugin config. - The goal is to simplify setup by avoiding manual rate limit rules for each endpoint in global `customRules`. - There has been no further activity or discussion on this request since it was opened. **Next Steps:** - Please let me know if this feature is still relevant to the latest version of better-auth by commenting on this issue. - If I do not hear back within 7 days, I will automatically close this issue. Thanks for your understanding and contribution!
GiteaMirror commented 2026-04-15 16:49:46 -05:00
Author
Owner
Copy Link

@issam-seghir commented on GitHub (Nov 7, 2025):

@dosubot yes it's still relevant to the latest version of better-auth

<!-- gh-comment-id:3501798020 --> @issam-seghir commented on GitHub (Nov 7, 2025): @dosubot yes it's still relevant to the latest version of better-auth
GiteaMirror commented 2026-04-15 16:49:47 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Feb 6, 2026):

Hi, @issam-seghir. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested a rateLimit configuration option for the emailOTP plugin to simplify overriding default rate limits.
  • This feature is similar to the existing rateLimit option in the magicLink plugin.
  • The issue was marked as stale due to inactivity.
  • You confirmed that the feature request is still relevant to the latest version of better-auth.
  • No further updates or development have occurred since your confirmation.

Next Steps:

  • Please let me know if this feature is still important for your use case by commenting on this issue.
  • If I do not hear back within 7 days, the issue will be automatically closed.

Thank you for your understanding and contribution!

<!-- gh-comment-id:3861256948 --> @dosubot[bot] commented on GitHub (Feb 6, 2026): Hi, @issam-seghir. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested a `rateLimit` configuration option for the `emailOTP` plugin to simplify overriding default rate limits. - This feature is similar to the existing `rateLimit` option in the `magicLink` plugin. - The issue was marked as stale due to inactivity. - You confirmed that the feature request is still relevant to the latest version of better-auth. - No further updates or development have occurred since your confirmation. **Next Steps:** - Please let me know if this feature is still important for your use case by commenting on this issue. - If I do not hear back within 7 days, the issue will be automatically closed. Thank you for your understanding and contribution!
GiteaMirror commented 2026-04-15 16:49:48 -05:00
Author
Owner
Copy Link

@issam-seghir commented on GitHub (Feb 7, 2026):

@dosubot yes it's still relevant to the latest version of better-auth

<!-- gh-comment-id:3863733147 --> @issam-seghir commented on GitHub (Feb 7, 2026): @dosubot yes it's still relevant to the latest version of better-auth
GiteaMirror commented 2026-04-15 16:49:49 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Feb 11, 2026):

Hello all, we're moving all feature requests or enhancement issues over to Github Discussions.

I've went ahead and created the discussion here:

https://github.com/better-auth/better-auth/discussions/7919

<!-- gh-comment-id:3883105368 --> @ping-maxwell commented on GitHub (Feb 11, 2026): Hello all, we're moving all feature requests or enhancement issues over to Github Discussions. I've went ahead and created the discussion here: https://github.com/better-auth/better-auth/discussions/7919
GiteaMirror commented 2026-04-15 16:49:49 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Apr 1, 2026):

This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.

<!-- gh-comment-id:4166559062 --> @github-actions[bot] commented on GitHub (Apr 1, 2026): This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#18371
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?