github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6848] accountLinking is NOT disabled by default #19284

New Issue
Closed
opened 2026-04-15 18:10:15 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 18:10:15 -05:00
Owner
Copy Link

Originally created by @mhamid3d on GitHub (Dec 18, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6848

Originally assigned to: @bytaesu on GitHub.

To Reproduce

  1. Do NOT add any accountLinking option in your auth instance
  2. Perform a social sign in on the client (not OneTap, as that plugin handles it properly, explained more below)
  3. See that account linking happens automatically

Current vs. Expected behavior

I expect the oauth callback to block the sign in request because accountLinking.enabled is mentioned to be false by default.

What version of Better Auth are you using?

1.4.6

Additional context

accountLinking.enabled will return undefined if the user doesn't explicitly set it. In several areas throughout the codebase, accountLinking.enabled is checked like this accountLinking?.enabled === false which will return false. But in OneTap, they just check if enabled is truthy, which is why the OneTap plugin properly honors the default false setting.

Also I will note, the typehint @default for accountLinking.enabled is true but in the docs it says false, this is misleading and confusing.

Originally created by @mhamid3d on GitHub (Dec 18, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6848 Originally assigned to: @bytaesu on GitHub. ### To Reproduce 1. Do NOT add any `accountLinking` option in your auth instance 2. Perform a social sign in on the client (not OneTap, as that plugin handles it properly, explained more below) 3. See that account linking happens automatically ### Current vs. Expected behavior I expect the oauth callback to block the sign in request because `accountLinking.enabled` is mentioned to be `false` by default. ### What version of Better Auth are you using? 1.4.6 ### Additional context `accountLinking.enabled` will return `undefined` if the user doesn't explicitly set it. In several areas throughout the codebase, `accountLinking.enabled` is checked like this `accountLinking?.enabled === false` which will return false. But in OneTap, they just check if enabled is truthy, which is why the OneTap plugin properly honors the default false setting. Also I will note, the typehint `@default` for `accountLinking.enabled` is `true` but in the docs it says false, this is misleading and confusing.
GiteaMirror added the lockedbug labels 2026-04-15 18:10:15 -05:00
GiteaMirror commented 2026-04-15 18:10:18 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Dec 18, 2025):

You're right—account linking is not disabled by default. In Better Auth v1.4.6, the code only blocks account linking if accountLinking.enabled is explicitly set to false. If you don't set it, the value is undefined, and the check accountLinking?.enabled === false fails, so linking happens automatically. This is why social sign-in links accounts by default unless you explicitly disable it. The OneTap plugin behaves differently because it checks if enabled is truthy, so if it's not set, linking doesn't happen—this matches the docs, but not the core OAuth logic.

There's a clear inconsistency: the type hint says @default true, the docs say false, and the actual behavior is "enabled unless explicitly set to false" (source, source, source). This has caused confusion for others as well.

If you want to disable account linking, you need to explicitly set accountLinking.enabled: false in your config. There is currently no way to allow only manual linking while blocking automatic linking; both are controlled by the same flag (source). It would be helpful for the maintainers to align the docs, type hints, and code logic to avoid this confusion.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3669203305 --> @dosubot[bot] commented on GitHub (Dec 18, 2025): <!-- Answer --> You're right—account linking is not disabled by default. In Better Auth v1.4.6, the code only blocks account linking if `accountLinking.enabled` is explicitly set to `false`. If you don't set it, the value is `undefined`, and the check `accountLinking?.enabled === false` fails, so linking happens automatically. This is why social sign-in links accounts by default unless you explicitly disable it. The OneTap plugin behaves differently because it checks if `enabled` is truthy, so if it's not set, linking doesn't happen—this matches the docs, but not the core OAuth logic. There's a clear inconsistency: the type hint says `@default true`, the docs say `false`, and the actual behavior is "enabled unless explicitly set to false" ([source](https://github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/packages/core/src/types/init-options.ts#L866-L901), [source](https://github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/packages/better-auth/src/api/routes/callback.ts#L20-L265), [source](https://github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/docs/content/docs/reference/options.mdx#L356-L391)). This has caused confusion for others as well. If you want to disable account linking, you need to explicitly set `accountLinking.enabled: false` in your config. There is currently no way to allow only manual linking while blocking automatic linking; both are controlled by the same flag ([source](https://github.com/better-auth/better-auth/issues/6392)). It would be helpful for the maintainers to align the docs, type hints, and code logic to avoid this confusion. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/9de96921-9f55-4a89-b141-3c6ae39a70dc?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27re%20right%E2%80%94account%20linking%20is%20not%20disabled%20by%20default.%20In%20Better%20Auth%20v1.4.6%2C%20the%20code%20only%20blocks%20account%20linking%20if%20%60accountLinking.enabled%60%20is%20explicitly%20set%20to%20%60false%60.%20If%20you%20don%27t%20set%20it%2C%20the%20value%20is%20%60undefined%60%2C%20and%20the%20check%20%60accountLinking%3F.enabled%20%3D%3D%3D%20false%60%20fails%2C%20so%20linking%20happens%20automatically.%20This%20is%20why%20social%20sign-in%20links%20accounts%20by%20default%20unless%20you%20explicitly%20disable%20it.%20The%20OneTap%20plugin%20behaves%20differently%20because%20it%20checks%20if%20%60enabled%60%20is%20truthy%2C%20so%20if%20it%27s%20not%20set%2C%20linking%20doesn%27t%20happen%E2%80%94this%20matches%20the%20docs%2C%20but%20not%20the%20core%20OAuth%20logic.%0A%0AThere%27s%20a%20clear%20inconsistency%3A%20the%20type%20hint%20says%20%60%40default%20true%60%2C%20the%20docs%20say%20%60false%60%2C%20and%20the%20actual%20behavior%20is%20%22enabled%20unless%20explicitly%20set%20to%20false%22%20%28%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/packages/core/src/types/init-options.ts%23L866-L901%29%2C%20%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/packages/better-auth/src/api/routes/callback.ts%23L20-L265%29%2C%20%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/blob/91cea0d0a79e6009eccda62e43c39cb44ef59625/docs/content/docs/reference/options.mdx%23L356-L391%29%29.%20This%20has%20caused%20confusion%20for%20others%20as%20well.%0A%0AIf%20you%20want%20to%20disable%20account%20linking%2C%20you%20need%20to%20explicitly%20set%20%60accountLinking.enabled%3A%20false%60%20in%20your%20config.%20There%20is%20currently%20no%20way%20to%20allow%20only%20manual%20linking%20while%20blocking%20automatic%20linking%3B%20both%20are%20controlled%20by%20the%20same%20flag%20%28%5Bsource%5D%28https%3A//github.com/better-auth/better-auth/issues/6392%29%29.%20It%20would%20be%20helpful%20for%20the%20maintainers%20to%20align%20the%20docs%2C%20type%20hints%2C%20and%20code%20logic%20to%20avoid%20this%20confusion.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6848)
GiteaMirror commented 2026-04-15 18:10:19 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Dec 18, 2025):

Hello @mhamid3d,

I'm looking into this

<!-- gh-comment-id:3669628979 --> @bytaesu commented on GitHub (Dec 18, 2025): Hello @mhamid3d, I'm looking into this
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19284
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?