github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 08:01:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

bug: unable to upload profile picture in .svg #3005

New Issue
Closed
opened 2026-03-13 10:34:00 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-03-13 10:34:00 -05:00
Owner
Copy Link

Originally created by @danpasecinic on GitHub (Mar 6, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Navigate to https://dash.better-auth.com/<org-name>/settings/account
  2. Try to upload a profile picture in .svg.

Current vs. Expected behavior

Current behavior is a 500 on POST to https://dash.better-auth.com/api/upload/direct with error "Failed to upload file".

Expected behavior is either to validate an input (.svg not allowed) or a successfully upload a picture.

What version of Better Auth are you using?

1.5.4

Additional context

Image
Originally created by @danpasecinic on GitHub (Mar 6, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Navigate to `https://dash.better-auth.com/<org-name>/settings/account` 2. Try to upload a profile picture in `.svg`. ### Current vs. Expected behavior Current behavior is a 500 on POST to `https://dash.better-auth.com/api/upload/direct` with error `"Failed to upload file"`. Expected behavior is either to validate an input (`.svg` not allowed) or a successfully upload a picture. ### What version of Better Auth are you using? 1.5.4 ### Additional context <img width="1400" height="1274" alt="Image" src="https://github.com/user-attachments/assets/e1f1fda2-e298-432c-b7b8-b43d4ce723fb" />
GiteaMirror added the infrabug labels 2026-03-13 10:34:00 -05:00
GiteaMirror commented 2026-03-13 10:34:03 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 6, 2026):

This issue appears to be specific to the Better Auth Dashboard (dash.better-auth.com), which is a separate hosted application—not part of the open-source Better Auth library itself.

The Better Auth library doesn't have built-in file upload functionality. It only stores profile images as URL strings via the updateUser endpoint, and the /api/upload/direct endpoint you're encountering exists in the dashboard application, not in the library.

Since this is a bug in the hosted dashboard rather than the library, it would likely need to be addressed by the Better Auth team's internal dashboard codebase.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Mar 6, 2026): <!-- Answer --> This issue appears to be specific to the **Better Auth Dashboard** (dash.better-auth.com), which is a separate hosted application—not part of the open-source Better Auth library itself. The Better Auth library [doesn't have built-in file upload functionality](https://github.com/better-auth/better-auth/discussions/6919#discussioncomment-15309626). It only stores profile images as URL strings via the [`updateUser` endpoint](https://github.com/better-auth/better-auth/blob/cb9e1bc1d16812dc9722af927df74eadcd508943/packages/better-auth/src/api/routes/update-user.ts#L24-L143), and the `/api/upload/direct` endpoint you're encountering exists in the dashboard application, not in the library. Since this is a bug in the hosted dashboard rather than the library, it would likely need to be addressed by the Better Auth team's internal dashboard codebase. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/1a697746-7e4c-414f-a152-699bdc9b1166?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20issue%20appears%20to%20be%20specific%20to%20the%20%2A%2ABetter%20Auth%20Dashboard%2A%2A%20%28dash.better-auth.com%29%2C%20which%20is%20a%20separate%20hosted%20application%E2%80%94not%20part%20of%20the%20open-source%20Better%20Auth%20library%20itself.%0A%0AThe%20Better%20Auth%20library%20%5Bdoesn%27t%20have%20built-in%20file%20upload%20functionality%5D%28https%3A//github.com/better-auth/better-auth/discussions/6919%23discussioncomment-15309626%29.%20It%20only%20stores%20profile%20images%20as%20URL%20strings%20via%20the%20%5B%60updateUser%60%20endpoint%5D%28https%3A//github.com/better-auth/better-auth/blob/cb9e1bc1d16812dc9722af927df74eadcd508943/packages/better-auth/src/api/routes/update-user.ts%23L24-L143%29%2C%20and%20the%20%60/api/upload/direct%60%20endpoint%20you%27re%20encountering%20exists%20in%20the%20dashboard%20application%2C%20not%20in%20the%20library.%0A%0ASince%20this%20is%20a%20bug%20in%20the%20hosted%20dashboard%20rather%20than%20the%20library%2C%20it%20would%20likely%20need%20to%20be%20addressed%20by%20the%20Better%20Auth%20team%27s%20internal%20dashboard%20codebase.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8446)
GiteaMirror commented 2026-03-13 10:34:03 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Mar 6, 2026):

Hi @danpasecinic,

Not allowing SVG uploads is common, since they can be an attack vector. we'll improve the upload flow UX 🙂

@bytaesu commented on GitHub (Mar 6, 2026): Hi @danpasecinic, Not allowing SVG uploads is common, since they can be an attack vector. we'll improve the upload flow UX 🙂
GiteaMirror commented 2026-03-13 10:34:03 -05:00
Author
Owner
Copy Link

@danpasecinic commented on GitHub (Mar 6, 2026):

Hi @danpasecinic,

Not allowing SVG uploads is common, since they can be an attack vector. we'll improve the upload flow UX 🙂

No worries, and indeed I do understand the reasons. Another extra validation will help for sure. Thanks!

@danpasecinic commented on GitHub (Mar 6, 2026): > Hi [@danpasecinic](https://github.com/danpasecinic), > > Not allowing SVG uploads is common, since they can be an attack vector. we'll improve the upload flow UX 🙂 No worries, and indeed I do understand the reasons. Another extra validation will help for sure. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug infra
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#3005
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?