github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3662] [MERGED] fix(anonymous): prevent false positive error on first anonymous sign-in #21843

New Issue
Closed
opened 2026-04-15 20:38:46 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 20:38:46 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3662
Author: @ajanraj
Created: 7/28/2025
Status: ✅ Merged
Merged: 9/12/2025
Merged by: @himself65

Base: canary ← Head: fix/anonymous-plugin-timing-issue

📝 Commits (3)

  • 9d337f3 fix(anonymous): prevent false positive error on first anonymous sign-in
  • 0f3d2d6 chore: apply lint fixes for anonymous plugin changes
  • 9b45e1d Delete .changeset/slimy-months-yawn.md

📊 Changes

2 files changed (+96 additions, -1 deletions)

View changed files

📝 packages/better-auth/src/plugins/anonymous/anon.test.ts (+77 -0)
📝 packages/better-auth/src/plugins/anonymous/index.ts (+19 -1)

📄 Description

Fixes #3658

Summary

Resolves timing issue where the anonymous plugin incorrectly rejected first-time anonymous sign-in attempts, causing users to receive 400 “Anonymous users cannot sign in again anonymously” errors despite successful user creation.

Root Cause

The issue occurred when apps automatically sign in anonymous users (e.g., in React useEffect on page load). The original implementation checked for existing sessions in an after hook, which couldn't distinguish between:

  • Sessions created in the current request (ctx.context.newSession)
  • Pre-existing sessions from previous requests.

Solution

Moved the session check from the after hook to the sign-in endpoint handler itself, where it properly detects existing anonymous sessions before attempting to create new users. This approach is:

  • ✅ More direct and reliable
  • ✅ Eliminates timing dependencies
  • ✅ Follows existing authentication patterns.

Changes

  • Core Fix: Added session check in /sign-in/anonymous endpoint handler (lines 124-133)
  • Comprehensive Tests: Added test cases for both first-time success and subsequent rejection scenarios
  • Maintained Compatibility: All existing functionality preserved, only fixed the false positive case

Test Results

✓ should sign in anonymously
✓ link anonymous user account  
✓ should link in social sign on
✓ should work with generateName
✓ should not reject first-time anonymous sign-in
✓ should reject subsequent anonymous sign-in attempts once signed in

Impact

  • Fixes: First-time anonymous sign-in now works correctly in automatic scenarios (useEffect, app load)
  • Maintains: Security - still prevents actual repeat anonymous sign-ins
  • Improves: Developer experience - no more confusing false positive errors

Files Changed

  • packages/better-auth/src/plugins/anonymous/index.ts - Core fix implementation
  • packages/better-auth/src/plugins/anonymous/anon.test.ts - Added comprehensive test coverage
  • .changeset/slimy-months-yawn.md - Changeset for version tracking

Breaking Changes

None - this is a pure bug fix that maintains all existing behavior while fixing the false positive case.

Summary by cubic

Fixed a bug where first-time anonymous sign-in attempts were incorrectly rejected with a 400 error, even though the user was new.

  • Bug Fixes
    • Moved the session check to the sign-in endpoint to properly allow first-time anonymous sign-ins.
    • Added tests to cover both successful first sign-ins and correct rejection of repeat attempts.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3662 **Author:** [@ajanraj](https://github.com/ajanraj) **Created:** 7/28/2025 **Status:** ✅ Merged **Merged:** 9/12/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `fix/anonymous-plugin-timing-issue` --- ### 📝 Commits (3) - [`9d337f3`](https://github.com/better-auth/better-auth/commit/9d337f3efaf32964b91dda08bcbe7b1cf1c9193c) fix(anonymous): prevent false positive error on first anonymous sign-in - [`0f3d2d6`](https://github.com/better-auth/better-auth/commit/0f3d2d6a37b95db976774f74845e9c14ca690c69) chore: apply lint fixes for anonymous plugin changes - [`9b45e1d`](https://github.com/better-auth/better-auth/commit/9b45e1d76b285c608182bf5c3cb91d5a235ceb64) Delete .changeset/slimy-months-yawn.md ### 📊 Changes **2 files changed** (+96 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/anonymous/anon.test.ts` (+77 -0) 📝 `packages/better-auth/src/plugins/anonymous/index.ts` (+19 -1) </details> ### 📄 Description **Fixes #3658** ## Summary Resolves timing issue where the anonymous plugin incorrectly rejected first-time anonymous sign-in attempts, causing users to receive 400 “Anonymous users cannot sign in again anonymously” errors despite successful user creation. ## Root Cause The issue occurred when apps automatically sign in anonymous users (e.g., in React useEffect on page load). The original implementation checked for existing sessions in an `after` hook, which couldn't distinguish between: - Sessions created in the current request (`ctx.context.newSession`) - Pre-existing sessions from previous requests. ## Solution Moved the session check from the `after` hook to the sign-in endpoint handler itself, where it properly detects existing anonymous sessions **before** attempting to create new users. This approach is: - ✅ More direct and reliable - ✅ Eliminates timing dependencies - ✅ Follows existing authentication patterns. ## Changes - **Core Fix**: Added session check in `/sign-in/anonymous` endpoint handler (lines 124-133) - **Comprehensive Tests**: Added test cases for both first-time success and subsequent rejection scenarios - **Maintained Compatibility**: All existing functionality preserved, only fixed the false positive case ## Test Results ``` ✓ should sign in anonymously ✓ link anonymous user account ✓ should link in social sign on ✓ should work with generateName ✓ should not reject first-time anonymous sign-in ✓ should reject subsequent anonymous sign-in attempts once signed in ``` ## Impact - **Fixes**: First-time anonymous sign-in now works correctly in automatic scenarios (useEffect, app load) - **Maintains**: Security - still prevents actual repeat anonymous sign-ins - **Improves**: Developer experience - no more confusing false positive errors ## Files Changed - `packages/better-auth/src/plugins/anonymous/index.ts` - Core fix implementation - `packages/better-auth/src/plugins/anonymous/anon.test.ts` - Added comprehensive test coverage - `.changeset/slimy-months-yawn.md` - Changeset for version tracking ## Breaking Changes None - this is a pure bug fix that maintains all existing behavior while fixing the false positive case. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixed a bug where first-time anonymous sign-in attempts were incorrectly rejected with a 400 error, even though the user was new. - **Bug Fixes** - Moved the session check to the sign-in endpoint to properly allow first-time anonymous sign-ins. - Added tests to cover both successful first sign-ins and correct rejection of repeat attempts. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 20:38:46 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#21843
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?