github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-22 15:59:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8908] [Bug] sentinel emailValidation.enabled config doesn't disable normalization in DB hooks #28556

New Issue
Closed
opened 2026-04-17 20:00:30 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 20:00:30 -05:00
Owner
Copy Link
Copy Source

Originally created by @aakashkulkarni on GitHub (Apr 2, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8908

Originally assigned to: @jonathansamines on GitHub.

Bug Description

When configuring sentinel with security: { emailValidation: { enabled: false } }, email normalization is only disabled in the request hook middleware path (via createEmailHooks), but NOT in the database hook user.create.before or any direct normalizeEmail() calls.

Minimal Reproduction

sentinel({
    apiKey: '...',
    security: { emailValidation: { enabled: false } },
})

Expected: emails are not normalized (e.g. user+tag@gmail.com stays as user+tag@gmail.com in the user table)

Actual: emails are still normalized in DB hooks (e.g. user+tag@gmail.com becomes user@gmail.com in the user table)

Root Cause

normalizeEmail() (around line ~1599 in @better-auth/infra@0.1.12 dist/index.mjs) checks:

context.getPlugin("sentinel")?.options?.emailValidation?.enabled === false

However, getPlugin() returns the raw plugin definition object, which has no .options property. Here's why:

  1. The sentinel plugin's init() method returns options that get merged into the global options object via defu in runPluginInit.
  2. But getPlugin(id) calls options.plugins.find(p => p.id === id), which returns the original plugin definition — not the merged global options.
  3. This means getPlugin("sentinel")?.options is always undefined, and the normalization guard never triggers.

Where it works vs. doesn't

Path Disabled by config?
Request hook middleware (createEmailHooks) ✅ Yes — checks emailConfig.enabled directly
user.create.before DB hook ❌ No — calls normalizeEmail() with broken guard
Direct normalizeEmail() calls (~12 occurrences) ❌ No — same broken guard

Suggested Fix

In normalizeEmail(), check context.options?.emailValidation?.enabled instead of context.getPlugin("sentinel")?.options?.emailValidation?.enabled, since runPluginInit merges the sentinel init result into context.options.

Version

@better-auth/infra@0.1.12
@better-auth/infra@0.1.13

Originally created by @aakashkulkarni on GitHub (Apr 2, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8908 Originally assigned to: @jonathansamines on GitHub. ## Bug Description When configuring sentinel with `security: { emailValidation: { enabled: false } }`, email normalization is only disabled in the request hook middleware path (via `createEmailHooks`), but **NOT** in the database hook `user.create.before` or any direct `normalizeEmail()` calls. ## Minimal Reproduction ```typescript sentinel({ apiKey: '...', security: { emailValidation: { enabled: false } }, }) ``` **Expected:** emails are not normalized (e.g. `user+tag@gmail.com` stays as `user+tag@gmail.com` in the user table) **Actual:** emails are still normalized in DB hooks (e.g. `user+tag@gmail.com` becomes `user@gmail.com` in the user table) ## Root Cause `normalizeEmail()` (around line ~1599 in `@better-auth/infra@0.1.12` dist/index.mjs) checks: ```js context.getPlugin("sentinel")?.options?.emailValidation?.enabled === false ``` However, `getPlugin()` returns the raw plugin definition object, which has no `.options` property. Here's why: 1. The sentinel plugin's `init()` method returns options that get merged into the **global** `options` object via `defu` in `runPluginInit`. 2. But `getPlugin(id)` calls `options.plugins.find(p => p.id === id)`, which returns the **original plugin definition** — not the merged global options. 3. This means `getPlugin("sentinel")?.options` is always `undefined`, and the normalization guard never triggers. ## Where it works vs. doesn't | Path | Disabled by config? | |------|-------------------| | Request hook middleware (`createEmailHooks`) | ✅ Yes — checks `emailConfig.enabled` directly | | `user.create.before` DB hook | ❌ No — calls `normalizeEmail()` with broken guard | | Direct `normalizeEmail()` calls (~12 occurrences) | ❌ No — same broken guard | ## Suggested Fix In `normalizeEmail()`, check `context.options?.emailValidation?.enabled` instead of `context.getPlugin("sentinel")?.options?.emailValidation?.enabled`, since `runPluginInit` merges the sentinel init result into `context.options`. ## Version `@better-auth/infra@0.1.12` `@better-auth/infra@0.1.13`
GiteaMirror added the devopsbug labels 2026-04-17 20:00:30 -05:00
GiteaMirror commented 2026-04-17 20:00:32 -05:00
Author
Owner
Copy Link
Copy Source

@tmcw commented on GitHub (Apr 13, 2026):

It's pretty surprising behavior that even sentinel will normalize emails: this isn't mentioned in the documentation except in a section for error messages which doesn't mention that sentinel is the plugin doing normalization. Coming from an different authentication provider that did not normalize email addresses, this was a pretty big gotcha of better auth.

<!-- gh-comment-id:4238638170 --> @tmcw commented on GitHub (Apr 13, 2026): It's pretty surprising behavior that even sentinel will normalize emails: this isn't mentioned in [the documentation](https://better-auth.com/docs/infrastructure/plugins/sentinel#email-validation) except in a section for error messages which doesn't mention that sentinel is the plugin doing normalization. Coming from an different authentication provider that did not normalize email addresses, this was a pretty big gotcha of better auth.
GiteaMirror commented 2026-04-17 20:00:32 -05:00
Author
Owner
Copy Link
Copy Source

@jonathansamines commented on GitHub (Apr 14, 2026):

Hey @tmcw @aakashkulkarni We just released @better-auth/infra v0.2.3 with a couple of changes:

  • The security: { emailValidation: { enabled: false } } should now be respected on all operations
  • We have introduced a separate option security: { emailNormalization: { enabled: false } } if you want more granular control and want to disable this feature. See email normalization

Please let us know if you are still seeing issues after the upgrade!

<!-- gh-comment-id:4246894255 --> @jonathansamines commented on GitHub (Apr 14, 2026): Hey @tmcw @aakashkulkarni We just released `@better-auth/infra` v0.2.3 with a couple of changes: - The `security: { emailValidation: { enabled: false } }` should now be respected on all operations - We have introduced a separate option `security: { emailNormalization: { enabled: false } }` if you want more granular control and want to disable this feature. See [email normalization](https://better-auth.com/docs/infrastructure/plugins/sentinel#email-normalization) Please let us know if you are still seeing issues after the upgrade!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels bug devops
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28556