github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #5978] Change email flow impossible without active session #19024

New Issue
Closed
opened 2026-04-15 17:47:50 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 17:47:50 -05:00
Owner
Copy Link

Originally created by @tomdenboon on GitHub (Nov 14, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5978

Currently the change email flow has been build by always requiring a session within the active context. This currently breaks, this flow if I create a change email request from expo. For this app I will never have a session on my betterauth server, since it will be mobile first and the session is managed in local storage on the mobile app.

My proposal is to remove the requirement for a session when using change email. I think this is possible because you already need a session to first request the email change. Second you need to have access to the email account that is already verified. Third it is using a very short-lived jwt token of an hour. I think this already covering most of the security and the extra session check is redundant and we can make it optional.

Originally created by @tomdenboon on GitHub (Nov 14, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5978 Currently the change email flow has been build by always requiring a session within the active context. This currently breaks, this flow if I create a change email request from expo. For this app I will never have a session on my betterauth server, since it will be mobile first and the session is managed in local storage on the mobile app. My proposal is to remove the requirement for a session when using change email. I think this is possible because you already need a session to first request the email change. Second you need to have access to the email account that is already verified. Third it is using a very short-lived jwt token of an hour. I think this already covering most of the security and the extra session check is redundant and we can make it optional.
GiteaMirror added the lockedenhancement labels 2026-04-15 17:47:50 -05:00
GiteaMirror commented 2026-04-15 17:47:53 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 14, 2025):

(tag @better-auth-agent if you would like an answer from the Agent)

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3530440989 --> @better-auth-agent[bot] commented on GitHub (Nov 14, 2025): (tag @better-auth-agent if you would like an answer from the Agent) <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-15 17:47:54 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 14, 2025):

Hi @tomdenboon! I'm Dosu and I’m helping the better-auth team.

You're right that the current change email flow in better-auth requires an active session to initiate the change, which causes issues for mobile-first apps like those built with Expo where sessions are managed locally and not on the server. The session check is enforced server-side, and there isn't a built-in option to make it optional for this flow yet. The security model relies on the initial session to request the change, access to the verified email, and a short-lived JWT for verification, which already covers the main risks [PR 5810].

To make the session requirement optional, you would need to adjust the API route or middleware that enforces the session check for the change email endpoint. This could involve adding logic to allow requests with a valid JWT (from the verification link) even if there is no active session, or introducing a configuration flag to relax the session requirement for mobile/stateless flows. The codebase is modular, so this change would likely be isolated to the relevant API handler or middleware.

There are ongoing discussions and some work towards more mobile-friendly, stateless authentication flows, but for now, a code change is needed to support your use case. Security should remain robust as long as the JWT is short-lived and the user must have access to the verified email to complete the change [PR 5810].

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3530448621 --> @dosubot[bot] commented on GitHub (Nov 14, 2025): <!-- Greeting --> Hi @tomdenboon! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You're right that the current change email flow in better-auth requires an active session to initiate the change, which causes issues for mobile-first apps like those built with Expo where sessions are managed locally and not on the server. The session check is enforced server-side, and there isn't a built-in option to make it optional for this flow yet. The security model relies on the initial session to request the change, access to the verified email, and a short-lived JWT for verification, which already covers the main risks [[PR 5810](https://github.com/better-auth/better-auth/pull/5810)]. To make the session requirement optional, you would need to adjust the API route or middleware that enforces the session check for the change email endpoint. This could involve adding logic to allow requests with a valid JWT (from the verification link) even if there is no active session, or introducing a configuration flag to relax the session requirement for mobile/stateless flows. The codebase is modular, so this change would likely be isolated to the relevant API handler or middleware. There are ongoing discussions and some work towards more mobile-friendly, stateless authentication flows, but for now, a code change is needed to support your use case. Security should remain robust as long as the JWT is short-lived and the user must have access to the verified email to complete the change [[PR 5810](https://github.com/better-auth/better-auth/pull/5810)]. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2ba28d88-d55e-41b2-ad98-abf6edef63ba?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5978)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19024
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?