better-auth/.changeset/fix-revert-2fa-broadening.md at @better-auth/api-key@1.7.0-beta.2

mirror of https://github.com/better-auth/better-auth.git synced 2026-08-02 11:03:49 -05:00

Files

T

Gustavo Valverde 225976c7d2 chore: main to next conflict resolution

Resolve the main to next sync discrepancies after the v1.6.4 release.

Conflict resolution:
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.4 sections below the 1.7.0-beta entries
- restore the next pre-release accumulator changesets that the stable release deleted on main

2026-04-15 15:40:35 +01:00

648 B

Raw Permalink Blame History

better-auth

better-auth
patch

fix(two-factor): revert enforcement broadening from #9122

Restores the pre-#9122 enforcement scope. 2FA is challenged only on /sign-in/email, /sign-in/username, and /sign-in/phone-number, matching the behavior that shipped through v1.6.2. Non-credential sign-in flows (magic link, email OTP, OAuth, SSO, passkey, SIWE, one-tap, phone-number OTP, device authorization, email-verification auto-sign-in) are no longer gated by a 2FA challenge by default.

A broader enforcement scope with per-method opt-outs and alignment to NIST SP 800-63B-4 authenticator assurance levels is planned for a future minor release.

648 B Raw Permalink Blame History

648 B

Raw Permalink Blame History