github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-18 11:32:15 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7102] feat: add password-history plugin #32678

New Issue
Open
opened 2026-04-17 23:26:04 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 23:26:04 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7102
Author: @saintparish4
Created: 1/2/2026
Status: 🔄 Open

Base: next ← Head: feat/pwd-reuse-plugin

📝 Commits (4)

📊 Changes

16 files changed (+2157 additions, -2 deletions)

View changed files

📝 packages/better-auth/src/plugins/index.ts (+1 -0)
➕ packages/better-auth/src/plugins/password-history/README.md (+206 -0)
➕ packages/better-auth/src/plugins/password-history/error-codes.ts (+6 -0)
➕ packages/better-auth/src/plugins/password-history/index.ts (+325 -0)
➕ packages/better-auth/src/plugins/password-history/password-history.test.ts (+455 -0)
➕ packages/better-auth/src/plugins/password-history/schema.ts (+29 -0)
➕ packages/password-history/README.md (+205 -0)
➕ packages/password-history/package.json (+63 -0)
➕ packages/password-history/src/error-codes.ts (+6 -0)
➕ packages/password-history/src/index.ts (+324 -0)
➕ packages/password-history/src/password-history.test.ts (+455 -0)
➕ packages/password-history/src/schema.ts (+29 -0)
➕ packages/password-history/tsconfig.json (+15 -0)
➕ packages/password-history/tsdown.config.ts (+8 -0)
➕ packages/password-history/vitest.config.ts (+8 -0)
📝 pnpm-lock.yaml (+22 -2)

📄 Description

add password history plugin to prevent password reuse

Add a password history plugin for Better Auth that prevents users from reusing their previous passwords, enhancing security by enforcing password rotation policies.

Features added:

  • Prevents password reuse by checking against current and historical passwords
  • Configurable history count (default: 5 previous passwords)
  • Support for multiple endpoints: /change-password, /reset-password, /set-password
  • Automatic cleanup of old password history entries beyond configured limit
  • Custom error messages for password reuse violations
  • Flexible path configuration to choose which endpoints enforce checks
  • Graceful error handling that doesn't block password changes if history check fails

Implementation details:

  • Database schema with passwordHistory table (userId, passwordHash, createdAt)
  • Database hooks for automatic password storage on account create/update
  • Before hooks for password validation on configured endpoints
  • Secure password verification using Better Auth's built-in password verification
  • Cascade deletion of password history when users are deleted

Files included:

  • index.ts: Main plugin implementation with validation and storage logic
  • schema.ts: Database schema definition for passwordHistory table
  • error-codes.ts: Error code definitions (PASSWORD_REUSED)
  • password-history.test.ts: Comprehensive test suite covering all scenarios
  • README.md: Complete documentation with usage examples and configuration options

Summary by cubic

Adds a password history plugin that blocks reusing current or recent passwords across change, reset, and set flows. Exposed via better-auth/plugins and as a new package @better-auth/password-history to strengthen account security.

  • New Features
    • Checks new passwords against the current and last N passwords (default: 5)
    • Enforced on /change-password, /reset-password, and /set-password; paths are configurable
    • Stores hashed passwords in a passwordHistory table with automatic pruning and cascade delete
    • Returns 400 PASSWORD_REUSED with customizable message; also exports $ERROR_CODES and degrades gracefully if the history check fails
    • Published as @better-auth/password-history and exported from better-auth/plugins; includes docs and tests

Written for commit 978d4a108f. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7102 **Author:** [@saintparish4](https://github.com/saintparish4) **Created:** 1/2/2026 **Status:** 🔄 Open **Base:** `next` ← **Head:** `feat/pwd-reuse-plugin` --- ### 📝 Commits (4) - [`c5b7fac`](https://github.com/better-auth/better-auth/commit/c5b7faca6a8b4180fb68f2b3bf3f1cba1d094696) feat(password-history): add password history plugin to prevent password reuse - [`ae77456`](https://github.com/better-auth/better-auth/commit/ae774569269352a6640ef676de9788bf355242e6) feat(password-history): add password history plugin to prevent password reuse - [`6b776f2`](https://github.com/better-auth/better-auth/commit/6b776f2c7cd56834e08c5b4e4aad959d13af48d9) Merge branch 'feat/pwd-reuse-plugin' of https://github.com/saintparish4/pwd-reuse-plugin into feat/pwd-reuse-plugin - [`978d4a1`](https://github.com/better-auth/better-auth/commit/978d4a108fe2a2f0f7d8b71d36d48c749f017831) Merge branch 'next' into feat/pwd-reuse-plugin ### 📊 Changes **16 files changed** (+2157 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/index.ts` (+1 -0) ➕ `packages/better-auth/src/plugins/password-history/README.md` (+206 -0) ➕ `packages/better-auth/src/plugins/password-history/error-codes.ts` (+6 -0) ➕ `packages/better-auth/src/plugins/password-history/index.ts` (+325 -0) ➕ `packages/better-auth/src/plugins/password-history/password-history.test.ts` (+455 -0) ➕ `packages/better-auth/src/plugins/password-history/schema.ts` (+29 -0) ➕ `packages/password-history/README.md` (+205 -0) ➕ `packages/password-history/package.json` (+63 -0) ➕ `packages/password-history/src/error-codes.ts` (+6 -0) ➕ `packages/password-history/src/index.ts` (+324 -0) ➕ `packages/password-history/src/password-history.test.ts` (+455 -0) ➕ `packages/password-history/src/schema.ts` (+29 -0) ➕ `packages/password-history/tsconfig.json` (+15 -0) ➕ `packages/password-history/tsdown.config.ts` (+8 -0) ➕ `packages/password-history/vitest.config.ts` (+8 -0) 📝 `pnpm-lock.yaml` (+22 -2) </details> ### 📄 Description add password history plugin to prevent password reuse Add a password history plugin for Better Auth that prevents users from reusing their previous passwords, enhancing security by enforcing password rotation policies. Features added: - Prevents password reuse by checking against current and historical passwords - Configurable history count (default: 5 previous passwords) - Support for multiple endpoints: /change-password, /reset-password, /set-password - Automatic cleanup of old password history entries beyond configured limit - Custom error messages for password reuse violations - Flexible path configuration to choose which endpoints enforce checks - Graceful error handling that doesn't block password changes if history check fails Implementation details: - Database schema with passwordHistory table (userId, passwordHash, createdAt) - Database hooks for automatic password storage on account create/update - Before hooks for password validation on configured endpoints - Secure password verification using Better Auth's built-in password verification - Cascade deletion of password history when users are deleted Files included: - index.ts: Main plugin implementation with validation and storage logic - schema.ts: Database schema definition for passwordHistory table - error-codes.ts: Error code definitions (PASSWORD_REUSED) - password-history.test.ts: Comprehensive test suite covering all scenarios - README.md: Complete documentation with usage examples and configuration options <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds a password history plugin that blocks reusing current or recent passwords across change, reset, and set flows. Exposed via `better-auth/plugins` and as a new package `@better-auth/password-history` to strengthen account security. - New Features - Checks new passwords against the current and last N passwords (default: 5) - Enforced on `/change-password`, `/reset-password`, and `/set-password`; paths are configurable - Stores hashed passwords in a `passwordHistory` table with automatic pruning and cascade delete - Returns 400 `PASSWORD_REUSED` with customizable message; also exports `$ERROR_CODES` and degrades gracefully if the history check fails - Published as `@better-auth/password-history` and exported from `better-auth/plugins`; includes docs and tests <sup>Written for commit 978d4a108fe2a2f0f7d8b71d36d48c749f017831. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 23:26:04 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#32678