github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-18 11:32:15 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7102] feat: add password-history plugin #7077

New Issue
Open
opened 2026-03-13 13:23:16 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:23:16 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7102
Author: @saintparish4
Created: 1/2/2026
Status: 🔄 Open

Base: canary ← Head: feat/pwd-reuse-plugin

📝 Commits (1)

  • c1fbef2 feat(password-history): add password history plugin to prevent password reuse

📊 Changes

7 files changed (+1028 additions, -0 deletions)

View changed files

📝 CONTRIBUTING.md (+6 -0)
📝 packages/better-auth/src/plugins/index.ts (+1 -0)
➕ packages/better-auth/src/plugins/password-history/README.md (+206 -0)
➕ packages/better-auth/src/plugins/password-history/error-codes.ts (+6 -0)
➕ packages/better-auth/src/plugins/password-history/index.ts (+325 -0)
➕ packages/better-auth/src/plugins/password-history/password-history.test.ts (+455 -0)
➕ packages/better-auth/src/plugins/password-history/schema.ts (+29 -0)

📄 Description

add password history plugin to prevent password reuse

Add a password history plugin for Better Auth that prevents users from reusing their previous passwords, enhancing security by enforcing password rotation policies.

Features added:

  • Prevents password reuse by checking against current and historical passwords
  • Configurable history count (default: 5 previous passwords)
  • Support for multiple endpoints: /change-password, /reset-password, /set-password
  • Automatic cleanup of old password history entries beyond configured limit
  • Custom error messages for password reuse violations
  • Flexible path configuration to choose which endpoints enforce checks
  • Graceful error handling that doesn't block password changes if history check fails

Implementation details:

  • Database schema with passwordHistory table (userId, passwordHash, createdAt)
  • Database hooks for automatic password storage on account create/update
  • Before hooks for password validation on configured endpoints
  • Secure password verification using Better Auth's built-in password verification
  • Cascade deletion of password history when users are deleted

Files included:

  • index.ts: Main plugin implementation with validation and storage logic
  • schema.ts: Database schema definition for passwordHistory table
  • error-codes.ts: Error code definitions (PASSWORD_REUSED)
  • password-history.test.ts: Comprehensive test suite covering all scenarios
  • README.md: Complete documentation with usage examples and configuration options

Summary by cubic

Adds a password history plugin that blocks password reuse across change, reset, and set flows. Improves account security with configurable history and safe error handling.

  • New Features
    • Checks new passwords against the current and last N passwords (default: 5)
    • Works on /change-password, /reset-password, and /set-password; paths are configurable
    • Automatically cleans up old history entries beyond the limit
    • Returns BAD_REQUEST with code PASSWORD_REUSED; supports custom error messages
    • Graceful failure: password changes aren’t blocked if the history check errors

Written for commit c1fbef2e875bbae3791fd6a834f79094ba439790. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7102 **Author:** [@saintparish4](https://github.com/saintparish4) **Created:** 1/2/2026 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `feat/pwd-reuse-plugin` --- ### 📝 Commits (1) - [`c1fbef2`](https://github.com/better-auth/better-auth/commit/c1fbef2e875bbae3791fd6a834f79094ba439790) feat(password-history): add password history plugin to prevent password reuse ### 📊 Changes **7 files changed** (+1028 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `CONTRIBUTING.md` (+6 -0) 📝 `packages/better-auth/src/plugins/index.ts` (+1 -0) ➕ `packages/better-auth/src/plugins/password-history/README.md` (+206 -0) ➕ `packages/better-auth/src/plugins/password-history/error-codes.ts` (+6 -0) ➕ `packages/better-auth/src/plugins/password-history/index.ts` (+325 -0) ➕ `packages/better-auth/src/plugins/password-history/password-history.test.ts` (+455 -0) ➕ `packages/better-auth/src/plugins/password-history/schema.ts` (+29 -0) </details> ### 📄 Description add password history plugin to prevent password reuse Add a password history plugin for Better Auth that prevents users from reusing their previous passwords, enhancing security by enforcing password rotation policies. Features added: - Prevents password reuse by checking against current and historical passwords - Configurable history count (default: 5 previous passwords) - Support for multiple endpoints: /change-password, /reset-password, /set-password - Automatic cleanup of old password history entries beyond configured limit - Custom error messages for password reuse violations - Flexible path configuration to choose which endpoints enforce checks - Graceful error handling that doesn't block password changes if history check fails Implementation details: - Database schema with passwordHistory table (userId, passwordHash, createdAt) - Database hooks for automatic password storage on account create/update - Before hooks for password validation on configured endpoints - Secure password verification using Better Auth's built-in password verification - Cascade deletion of password history when users are deleted Files included: - index.ts: Main plugin implementation with validation and storage logic - schema.ts: Database schema definition for passwordHistory table - error-codes.ts: Error code definitions (PASSWORD_REUSED) - password-history.test.ts: Comprehensive test suite covering all scenarios - README.md: Complete documentation with usage examples and configuration options <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds a password history plugin that blocks password reuse across change, reset, and set flows. Improves account security with configurable history and safe error handling. - **New Features** - Checks new passwords against the current and last N passwords (default: 5) - Works on /change-password, /reset-password, and /set-password; paths are configurable - Automatically cleans up old history entries beyond the limit - Returns BAD_REQUEST with code PASSWORD_REUSED; supports custom error messages - Graceful failure: password changes aren’t blocked if the history check errors <sup>Written for commit c1fbef2e875bbae3791fd6a834f79094ba439790. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:23:16 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7077