github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #2622] Add enabledPaths option #26600

New Issue
Closed
opened 2026-04-17 17:14:05 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-17 17:14:05 -05:00
Owner
Copy Link

Originally created by @vladshcherbin on GitHub (May 11, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/2622

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Hey 👋

I'm using Email OTP auth, without password and social providers so my api usage is minimal - basically sign in, sign out and verify OTP.

I don't need the rest of API routes to be open to public and want to disable them. Using disabledPaths option requires knowledge of all possible API paths and constant check of added/updated ones which is inconvenient and undesired.

Would be much easier to have enabledPaths option with rest routes disabled.

Thank you 🙌

Describe the solution you'd like

I'd like to have enabledPaths option where I can specify routes I need and have the rest disabled.

Describe alternatives you've considered

I can use disabledPaths, find all core route paths, plugin ones and check again on package updates but it's very inconvenient and undesired.

Additional context

better-auth 1.2.7

Originally created by @vladshcherbin on GitHub (May 11, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/2622 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Hey 👋 I'm using Email OTP auth, without password and social providers so my api usage is minimal - basically sign in, sign out and verify OTP. I don't need the rest of API routes to be open to public and want to disable them. Using `disabledPaths` option requires knowledge of all possible API paths and constant check of added/updated ones which is inconvenient and undesired. Would be much easier to have `enabledPaths` option with rest routes disabled. Thank you 🙌 ### Describe the solution you'd like I'd like to have `enabledPaths` option where I can specify routes I need and have the rest disabled. ### Describe alternatives you've considered I can use `disabledPaths`, find all core route paths, plugin ones and check again on package updates but it's very inconvenient and undesired. ### Additional context better-auth 1.2.7
GiteaMirror added the locked label 2026-04-17 17:14:05 -05:00
GiteaMirror commented 2026-04-17 17:14:06 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 10, 2025):

Hi, @vladshcherbin. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested an enabledPaths option to specify only the API routes to enable, disabling all others by default.
  • This feature is intended to simplify securing Email OTP authentication by avoiding manual tracking and disabling of unused routes.
  • You find the current disabledPaths approach inconvenient and error-prone.
  • There has been no further activity or comments on this issue since it was opened.

Next Steps:

  • Please let me know if this feature request is still relevant to the latest version of better-auth by commenting on this issue.
  • If I do not hear back within 7 days, I will automatically close this issue.

Thank you for your understanding and contribution!

<!-- gh-comment-id:3172736137 --> @dosubot[bot] commented on GitHub (Aug 10, 2025): Hi, @vladshcherbin. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested an `enabledPaths` option to specify only the API routes to enable, disabling all others by default. - This feature is intended to simplify securing Email OTP authentication by avoiding manual tracking and disabling of unused routes. - You find the current `disabledPaths` approach inconvenient and error-prone. - There has been no further activity or comments on this issue since it was opened. **Next Steps:** - Please let me know if this feature request is still relevant to the latest version of better-auth by commenting on this issue. - If I do not hear back within 7 days, I will automatically close this issue. Thank you for your understanding and contribution!
GiteaMirror commented 2026-04-17 17:14:06 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Aug 11, 2025):

While I understand your suggestion would make things easier for you, I don't believe many people are facing the same issue as you. This will only increase complexity on our end to manage. If anything I can understand regex for disablePaths to make things easier.
I'll be closing this as not planned.

<!-- gh-comment-id:3176163752 --> @ping-maxwell commented on GitHub (Aug 11, 2025): While I understand your suggestion would make things easier for you, I don't believe many people are facing the same issue as you. This will only increase complexity on our end to manage. If anything I can understand regex for disablePaths to make things easier. I'll be closing this as not planned.
GiteaMirror commented 2026-04-17 17:14:07 -05:00
Author
Owner
Copy Link

@sh2aliyev commented on GitHub (Aug 19, 2025):

I could argue that enabledPaths would be more useful and makes more sense compared to the current disabledPaths btw.

<!-- gh-comment-id:3201098342 --> @sh2aliyev commented on GitHub (Aug 19, 2025): I could argue that `enabledPaths` would be more useful and makes more sense compared to the current `disabledPaths` btw.
GiteaMirror commented 2026-04-17 17:14:07 -05:00
Author
Owner
Copy Link

@vladshcherbin commented on GitHub (Aug 19, 2025):

Of course it's much easier to define enabledPaths which makes perfect sense. The proposed solution to enumerate all disabled app paths and keep track of them is just nuts and can only come from a user who don't use this option or very familiar with internals and who follows all changelogs.

<!-- gh-comment-id:3201188454 --> @vladshcherbin commented on GitHub (Aug 19, 2025): Of course it's much easier to define `enabledPaths` which makes perfect sense. The proposed solution to enumerate all disabled app paths and keep track of them is just nuts and can only come from a user who don't use this option or very familiar with internals and who follows all changelogs.
GiteaMirror commented 2026-04-17 17:14:08 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Sep 27, 2025):

Hey guys, this could help your issue as well:
https://github.com/better-auth/better-auth/pull/3937/

Although It's not directly implementing enabledPaths, but will help with keeping track of open paths.

Also I've seen more cases where the need of enabledPaths makes sense, so I think this is good.

<!-- gh-comment-id:3342090724 --> @ping-maxwell commented on GitHub (Sep 27, 2025): Hey guys, this could help your issue as well: https://github.com/better-auth/better-auth/pull/3937/ Although It's not directly implementing `enabledPaths`, but will help with keeping track of open paths. Also I've seen more cases where the need of `enabledPaths` makes sense, so I think this is good.
GiteaMirror commented 2026-04-17 17:14:08 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Dec 27, 2025):

Hi, @vladshcherbin. I'm Dosu (https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested an enabledPaths option to specify API routes to enable, aiming to simplify Email OTP security by disabling all others by default.
  • The current approach uses disabledPaths, which you find inconvenient.
  • The maintainer initially closed the request due to increased complexity but acknowledged improvements to regex handling for disabledPaths.
  • Another user supported the enabledPaths idea as more intuitive.
  • A related PR (#3937) was shared to help track open paths, which may partially address your concern.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 7 days.

Thank you for your understanding and contribution!

<!-- gh-comment-id:3694068248 --> @dosubot[bot] commented on GitHub (Dec 27, 2025): Hi, @vladshcherbin. I'm Dosu (https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested an `enabledPaths` option to specify API routes to enable, aiming to simplify Email OTP security by disabling all others by default. - The current approach uses `disabledPaths`, which you find inconvenient. - The maintainer initially closed the request due to increased complexity but acknowledged improvements to regex handling for `disabledPaths`. - Another user supported the `enabledPaths` idea as more intuitive. - A related PR (#3937) was shared to help track open paths, which may partially address your concern. **Next Steps:** - Please let me know if this issue is still relevant with the latest version of better-auth by commenting here to keep the discussion open. - Otherwise, this issue will be automatically closed in 7 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#26600
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?