[PR #6143] [MERGED] fix(device-authorization): sanitize user code input on device approve #32079

New Issue

2026-04-17T22:56:35-05:00

GiteaMirror commented

2026-04-17 22:56:35 -05:00

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6143
Author: @Bekacru
Created: 11/20/2025
Status: ✅ Merged
Merged: 11/21/2025
Merged by: @Bekacru

Base: canary ← Head: refactor/device-authorization

📝 Commits (1)

7792722 fix(device-authorization): sanitize user code input on device approve

📊 Changes

1 file changed (+13 additions, -12 deletions)

View changed files

📝 packages/better-auth/src/plugins/device-authorization/index.ts (+13 -12)

📄 Description

Summary by cubic

Allows device approval with hyphenated user codes and deletes device codes only after successful authorization. Prevents lookup failures and premature cleanup during the device flow.

Bug Fixes
- Normalize user code by removing dashes before lookup on approve.
- Move device code deletion to run after authorization succeeds.

^{Written for commit 779272243b. Summary will update automatically on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6143 **Author:** [@Bekacru](https://github.com/Bekacru) **Created:** 11/20/2025 **Status:** ✅ Merged **Merged:** 11/21/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `refactor/device-authorization` --- ### 📝 Commits (1) - [`7792722`](https://github.com/better-auth/better-auth/commit/779272243bc202d5b438aec713dccb8a63d53127) fix(device-authorization): sanitize user code input on device approve ### 📊 Changes **1 file changed** (+13 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/device-authorization/index.ts` (+13 -12) </details> ### 📄 Description  ## Summary by cubic Allows device approval with hyphenated user codes and deletes device codes only after successful authorization. Prevents lookup failures and premature cleanup during the device flow. - **Bug Fixes** - Normalize user code by removing dashes before lookup on approve. - Move device code deletion to run after authorization succeeds. <sup>Written for commit 779272243bc202d5b438aec713dccb8a63d53127. Summary will update automatically on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-17 22:56:35 -05:00

GiteaMirror closed this issue

2026-04-17 22:56:36 -05:00

Sign in to join this conversation.

Branches Tags

dependabot/npm_and_yarn/next-16.2.11

dependabot/npm_and_yarn/docs/next-16.2.11

changeset-release/main

main

dependabot/npm_and_yarn/hono/node-server-2.0.10

dependabot/npm_and_yarn/body-parser-2.3.0

dependabot/npm_and_yarn/hono-4.12.27

dependabot/github_actions/github-actions-16786b339b

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

dependabot/npm_and_yarn/undici-7.28.0

2026-07-18/fix/expo-secure-store-async

feat/oauth-provider-remove-silence-warnings

dependabot/npm_and_yarn/vite-7.3.5

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

feat/oauth-provider-custom-subject

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#32079