mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-19 11:24:57 -05:00
Bereket Engida
71a9d682c1
The verify endpoint already forwards an APIError from a rejected user.create.before hook to errorCallbackURL, but the createSession call right after it was unguarded. A session.create.before hook that throws an APIError (e.g. the admin plugin's BANNED_USER) escaped as a raw error response instead of redirecting, unlike the createUser path a few lines above. Wrap createSession in the same try/catch pattern used for createUser.