github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6384] feat(email): add requireVerificationOnOldEmail option #6630

New Issue
Open
opened 2026-03-13 13:06:06 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:06:06 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6384
Author: @yoshifumi-kondo
Created: 11/28/2025
Status: 🔄 Open

Base: canary ← Head: feat/configurable-email-change-verification

📝 Commits (4)

  • 760cfda feat(email): add requireVerificationOnOldEmail option
  • d9723ee Merge branch 'canary' into feat/configurable-email-change-verification
  • 2708488 Merge branch 'canary' into feat/configurable-email-change-verification
  • 156ecfe Merge branch 'canary' into feat/configurable-email-change-verification

📊 Changes

3 files changed (+148 additions, -0 deletions)

View changed files

📝 packages/better-auth/src/api/routes/update-user.test.ts (+133 -0)
📝 packages/better-auth/src/api/routes/update-user.ts (+4 -0)
📝 packages/core/src/types/init-options.ts (+11 -0)

📄 Description

Summary

  • Add requireVerificationOnOldEmail option to user.changeEmail config
  • When set to false, skips sending confirmation email to the old email address and sends verification directly to the new email
  • Useful when users no longer have access to their old email address
  • Default is true to maintain backward compatibility and security

Closes #3742

Implementation Notes

Naming Decision

The original issue proposed sendOldEmailVerification under emailVerification, but I chose requireVerificationOnOldEmail under user.changeEmail because:

  1. It sits alongside related options (sendChangeEmailConfirmation, sendChangeEmailVerification)
  2. The name describes what is required rather than what is sent
  3. Maintains consistency with the existing config structure

Happy to change the naming if maintainers prefer the original proposal.

Security Consideration

As @himself65 noted in the issue, old email verification adds security against account hijacking. The default true preserves this security. Developers opting out should understand the trade-off.

Test Plan

  • Added test for requireVerificationOnOldEmail: false - verifies old email confirmation is skipped and new email gets direct verification
  • Added test for default behavior (true) - verifies old email confirmation is still called
  • Existing tests pass (1187 passed, 7 failed in unrelated Vercel Provider tests)

Summary by cubic

Added the requireVerificationOnOldEmail option to user.changeEmail to control whether we confirm via the old email before verifying the new one. When false, we skip the old email confirmation and send verification directly to the new email; default stays true for security and backward compatibility.

  • New Features

    • New config: user.changeEmail.requireVerificationOnOldEmail (default true).
    • changeEmail endpoint skips old-email confirmation when false and sends new-email verification.
    • Types updated and tests added for both behaviors.

  • Migration

    • No changes needed. To allow direct new-email verification, set requireVerificationOnOldEmail: false in user.changeEmail.

Written for commit 156ecfe6fd. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6384 **Author:** [@yoshifumi-kondo](https://github.com/yoshifumi-kondo) **Created:** 11/28/2025 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `feat/configurable-email-change-verification` --- ### 📝 Commits (4) - [`760cfda`](https://github.com/better-auth/better-auth/commit/760cfda46a9ee658a46b0076a84d2b17e322cf9d) feat(email): add requireVerificationOnOldEmail option - [`d9723ee`](https://github.com/better-auth/better-auth/commit/d9723ee9845d4427d5eeedab5bf71e71162fcacf) Merge branch 'canary' into feat/configurable-email-change-verification - [`2708488`](https://github.com/better-auth/better-auth/commit/27084889654dd8f0196e0acc8fe95f4a3319c25b) Merge branch 'canary' into feat/configurable-email-change-verification - [`156ecfe`](https://github.com/better-auth/better-auth/commit/156ecfe6fddea6927e6d028008f1ad2c4a4e447a) Merge branch 'canary' into feat/configurable-email-change-verification ### 📊 Changes **3 files changed** (+148 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/update-user.test.ts` (+133 -0) 📝 `packages/better-auth/src/api/routes/update-user.ts` (+4 -0) 📝 `packages/core/src/types/init-options.ts` (+11 -0) </details> ### 📄 Description ## Summary - Add `requireVerificationOnOldEmail` option to `user.changeEmail` config - When set to `false`, skips sending confirmation email to the old email address and sends verification directly to the new email - Useful when users no longer have access to their old email address - Default is `true` to maintain backward compatibility and security Closes #3742 ## Implementation Notes ### Naming Decision The original issue proposed `sendOldEmailVerification` under `emailVerification`, but I chose `requireVerificationOnOldEmail` under `user.changeEmail` because: 1. It sits alongside related options (`sendChangeEmailConfirmation`, `sendChangeEmailVerification`) 2. The name describes *what is required* rather than *what is sent* 3. Maintains consistency with the existing config structure Happy to change the naming if maintainers prefer the original proposal. ### Security Consideration As @himself65 noted in the issue, old email verification adds security against account hijacking. The default `true` preserves this security. Developers opting out should understand the trade-off. ## Test Plan - [x] Added test for `requireVerificationOnOldEmail: false` - verifies old email confirmation is skipped and new email gets direct verification - [x] Added test for default behavior (`true`) - verifies old email confirmation is still called - [x] Existing tests pass (1187 passed, 7 failed in unrelated Vercel Provider tests) <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Added the requireVerificationOnOldEmail option to user.changeEmail to control whether we confirm via the old email before verifying the new one. When false, we skip the old email confirmation and send verification directly to the new email; default stays true for security and backward compatibility. - **New Features** - New config: user.changeEmail.requireVerificationOnOldEmail (default true). - changeEmail endpoint skips old-email confirmation when false and sends new-email verification. - Types updated and tests added for both behaviors. - **Migration** - No changes needed. To allow direct new-email verification, set requireVerificationOnOldEmail: false in user.changeEmail. <sup>Written for commit 156ecfe6fddea6927e6d028008f1ad2c4a4e447a. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:06:06 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6630
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?