github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #404] Social Link Account Redirect URI Behavior works like sign-in #8254

New Issue
Closed
opened 2026-04-13 03:20:28 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 03:20:28 -05:00
Owner
Copy Link

Originally created by @geejayjay on GitHub (Nov 3, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/404

Version: v7.0.1

Description:
The social link account redirect URI is the same as social sign-in, resulting in unintended session creation and account log-in and log-out behavior. Specifically, when linking a social account, if the email associated with the social provider does not match the logged-in user's email, the current behavior is to either create a new user account or log in to a different account, rather than linking to the existing logged-in user.

Current Behavior:

  • When the social link redirect URI is invoked, a new session is created, mirroring the social sign-in process.
  • If the email associated with the social provider does not match the logged-in user's email, instead of linking to the existing session, it results in:
    • Logging into an existing account if it finds a match based on the social provider.
    • Creating a new account if no matching user is found.

Expected Behavior:

  1. If linking to a different email is allowed:

    • Create a new entry in the accounts table to track the new email/social account linkage.

  2. If linking to a different email is not allowed:

    • Return a validation error indicating the email mismatch and prevent the linking action.

  3. If the user is linked correctly:

    • Maintain the current session without creating a new one.
Originally created by @geejayjay on GitHub (Nov 3, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/404 **Version:** v7.0.1 **Description:** The social link account redirect URI is the same as social sign-in, resulting in unintended session creation and account log-in and log-out behavior. Specifically, when linking a social account, if the email associated with the social provider does not match the logged-in user's email, the current behavior is to either create a new user account or log in to a different account, rather than linking to the existing logged-in user. **Current Behavior:** - When the social link redirect URI is invoked, a new session is created, mirroring the social sign-in process. - If the email associated with the social provider does not match the logged-in user's email, instead of linking to the existing session, it results in: - Logging into an existing account if it finds a match based on the social provider. - Creating a new account if no matching user is found. **Expected Behavior:** 1. **If linking to a different email is allowed**: - Create a new entry in the accounts table to track the new email/social account linkage. 2. **If linking to a different email is not allowed**: - Return a validation error indicating the email mismatch and prevent the linking action. 3. **If the user is linked correctly**: - Maintain the current session without creating a new one.
GiteaMirror added the locked label 2026-04-13 03:20:28 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8254
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?