better-auth 1.7.14 → 1.7.16

package/dist/api/dispatch.mjs

@@ -243,7 +243,7 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		});
 		if (result instanceof Response) return result;
 		internalContext.context.returned = result.response;
-		internalContext.context.responseHeaders = result.headers ?? void 0;
+		mergeResponseHeaders(internalContext.context, result.headers);
 		const after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
 		if (after.response !== void 0) result.response = after.response;
 		result.headers = after.headers ?? result.headers;

package/dist/api/index.d.mts

@@ -21,6 +21,7 @@ import { updateSession } from "./routes/update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import "./routes/index.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { markSessionOutsideStore } from "./state/session-source.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { AuthContext, Awaitable, BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { InternalLogger } from "@better-auth/core/env";
@@ -4048,4 +4049,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -2,9 +2,9 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -18,6 +18,7 @@ import { updateSession } from "./routes/update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { markSessionOutsideStore } from "./state/session-source.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
@@ -222,4 +223,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/account.mjs

@@ -1,13 +1,16 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -129,7 +132,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 		*/
 		additionalData: z.record(z.string(), z.any()).optional()
 	}),
-	use: [sessionMiddleware],
+	use: [sensitiveSessionMiddleware],
 	metadata: { openapi: {
 		description: "Link a social account to the user",
 		operationId: "linkSocialAccount",
@@ -169,11 +172,12 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
 		}
-		const linkingUserInfo = await provider.getUserInfo({
+		const oauthTokens = {
 			idToken: token,
 			accessToken: c.body.idToken.accessToken,
 			refreshToken: c.body.idToken.refreshToken
-		});
+		};
+		const linkingUserInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!linkingUserInfo || !linkingUserInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -204,7 +208,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -237,7 +241,11 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
-			email: session.user.email
+			email: session.user.email,
+			encryptedSessionToken: await symmetricEncrypt({
+				key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+				data: session.session.token
+			})
 		},
 		additionalData: c.body.additionalData,
 		idTokenNonce

package/dist/api/routes/email-verification.mjs

@@ -26,7 +26,7 @@ async function sendVerificationEmailFn(ctx, user) {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 	const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 	await ctx.context.options.emailVerification.sendVerificationEmail({
@@ -183,24 +183,30 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 	const parsed = z.object({
 		email: z.email(),
 		updateTo: z.string().optional(),
-		requestType: z.string().optional()
+		requestType: z.string().optional(),
+		userId: z.string().optional()
 	}).parse(jwt.payload);
-	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
-	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
 	if (parsed.updateTo) {
+		if (!parsed.userId) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
+		const boundUser = await ctx.context.internalAdapter.findUserById(parsed.userId);
+		if (!boundUser) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+		if (boundUser.email.toLowerCase() !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 		const session = await getSessionFromCtx(ctx);
-		if (session && session.user.email !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
+		if (session && session.user.id !== boundUser.id) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
 		switch (parsed.requestType) {
 			/**
 			* User clicks confirmation -> sends verification to new email
 			*/
 			case "change-email-confirmation": {
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, {
+					requestType: "change-email-verification",
+					userId: boundUser.id
+				});
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: {
-						...user.user,
+						...boundUser,
 						email: parsed.updateTo
 					},
 					url,
@@ -213,26 +219,18 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* User clicks verification -> updates email
 			*/
 			case "change-email-verification": {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const emailVerified = boundUser.emailVerified;
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
-					emailVerified: true
+					emailVerified
 				});
-				if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (emailVerified && ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
-						emailVerified: true
+						emailVerified
 					}
 				});
 				if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
@@ -248,30 +246,21 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* - updates email immediately
 			*/
 			default: {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
 					emailVerified: false
 				});
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo, void 0, void 0, { userId: boundUser.id });
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: updatedUser,
 					url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
 					token: newToken
 				}, safeCloneRequest(ctx.request)));
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
 						emailVerified: false
 					}
@@ -284,6 +273,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			}
 		}
 	}
+	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
+	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+	if (parsed.userId && parsed.userId !== user.user.id) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 	if (user.user.emailVerified) {
 		if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
 		return ctx.json({

package/dist/api/routes/sign-in.mjs

@@ -167,7 +167,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			refreshToken: c.body.idToken.refreshToken,
 			user: c.body.idToken.user
 		};
-		const userInfo = await provider.getUserInfo(oauthTokens);
+		const userInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!userInfo || !userInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -338,7 +338,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
 		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/sign-up.mjs

@@ -239,7 +239,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			password: hash
 		});
 		if (ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: createdUser.id });
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/update-user.mjs

@@ -450,7 +450,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn);
+		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 		ctx.context.logger.info("Change email attempt for existing email");
 		return ctx.json({ status: true });
 	}
@@ -467,7 +467,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 			}
 		});
 		if (canSendVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 			await ctx.context.runInBackgroundOrAwait(canSendVerification({
 				user: {
@@ -484,7 +484,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 	* If the email is verified, we need to send a verification email
 	*/
 	if (canSendConfirmation) {
-		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-confirmation" });
+		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+			requestType: "change-email-confirmation",
+			userId: ctx.context.session.user.id
+		});
 		const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 		await ctx.context.runInBackgroundOrAwait(canSendConfirmation({
 			user: ctx.context.session.user,
@@ -498,7 +501,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+		requestType: "change-email-verification",
+		userId: ctx.context.session.user.id
+	});
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 	await ctx.context.runInBackgroundOrAwait(canSendVerification({
 		user: {

package/dist/api/state/session-source.d.mts

@@ -0,0 +1,10 @@
+//#region src/api/state/session-source.d.ts
+/**
+ * Marks the request session with `token` as built without a session-store
+ * row. Checks that re-read the store to catch a concurrent revocation skip
+ * such sessions.
+ *
+ * @internal Shared by Better Auth packages; not a supported public API.
+ */
+export declare function markSessionOutsideStore(token: string): Promise<void>;
+//#endregion

package/dist/api/state/session-source.mjs

@@ -0,0 +1,28 @@
+import { defineRequestState } from "@better-auth/core/context";
+//#region src/api/state/session-source.ts
+/**
+* Tokens of request sessions that a plugin built without a session-store
+* row, such as one authenticated by an API key on every request.
+*/
+const { get: getTokensOutsideStore } = defineRequestState(() => /* @__PURE__ */ new Set());
+/**
+* Marks the request session with `token` as built without a session-store
+* row. Checks that re-read the store to catch a concurrent revocation skip
+* such sessions.
+*
+* @internal Shared by Better Auth packages; not a supported public API.
+*/
+async function markSessionOutsideStore(token) {
+	(await getTokensOutsideStore()).add(token);
+}
+/**
+* Whether the request session with `token` was marked by
+* `markSessionOutsideStore`. Outside a request, nothing is marked.
+*
+* @internal Shared by Better Auth packages; not a supported public API.
+*/
+async function isSessionOutsideStore(token) {
+	return (await getTokensOutsideStore().catch(() => null))?.has(token) ?? false;
+}
+//#endregion
+export { isSessionOutsideStore, markSessionOutsideStore };

package/dist/auth/trusted-origins.mjs

@@ -4,6 +4,19 @@ import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
+const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/**
+* A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
+* `10.*`) names an address range, so it admits only an IPv4 address. A plain
+* `*` would otherwise cross `.` and let `192.168.attacker.com` match. Other
+* hosts keep the documented subdomain matching.
+*/
+const isAllowedIPv4Host = (patternAuthority, authority) => {
+	const patternHost = patternAuthority.split(":")[0];
+	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
+	return IPV4_HOST_PATTERN.test(authority.split(":")[0]);
+};
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -33,7 +46,7 @@ const normalizePath = (path) => {
 * host); the path is percent-decoded and resolved so traversal cannot bypass
 * a path-pinned pattern.
 */
-const parseCustomSchemeOrigin = (value) => {
+const parseCustomSchemeOrigin = (value, wildcardPattern = false) => {
 	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
@@ -42,7 +55,7 @@ const parseCustomSchemeOrigin = (value) => {
 	let authority = "";
 	if (rest.startsWith("//")) {
 		rest = rest.slice(2);
-		const authorityEnd = rest.search(/[/?#]/);
+		const authorityEnd = rest.search(wildcardPattern ? /[/#]/ : /[/?#]/);
 		if (authorityEnd === -1) {
 			authority = rest;
 			rest = "";
@@ -51,7 +64,7 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const pathEnd = rest.search(/[?#]/);
+	const pathEnd = rest.search(wildcardPattern ? /#/ : /[?#]/);
 	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
@@ -87,17 +100,27 @@ const isSafeRelativeURL = (value) => {
 */
 const matchesOriginPattern = (url, pattern, settings) => {
 	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
-	if (pattern.includes("*") || pattern.includes("?")) {
-		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+	const hasWildcard = pattern.includes("*") || pattern.includes("?");
+	if (hasWildcard && !pattern.includes("://")) {
 		const host = getHost(url);
 		if (!host) return false;
-		return wildcardMatch(pattern)(host);
+		return wildcardMatch(pattern)(host) && isAllowedIPv4Host(pattern, host);
 	}
 	const protocol = getProtocol(url);
-	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) {
+		if (!hasWildcard) return pattern === getOrigin(url);
+		const origin = getOrigin(url);
+		if (origin === null || !wildcardMatch(pattern)(origin)) return false;
+		return isAllowedIPv4Host(pattern.slice(pattern.indexOf("://") + 3), origin.slice(origin.indexOf("://") + 3));
+	}
 	const parsed = parseCustomSchemeOrigin(url);
-	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	const parsedPattern = parseCustomSchemeOrigin(pattern, hasWildcard);
 	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (hasWildcard) {
+		if (parsed.authority.includes("@")) return false;
+		if (parsedPattern.authority && !(wildcardMatch(parsedPattern.authority)(parsed.authority) && isAllowedIPv4Host(parsedPattern.authority, parsed.authority))) return false;
+		return !parsedPattern.path || wildcardMatch(parsedPattern.path)(parsed.path || "/");
+	}
 	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
 	if (!parsedPattern.path) return true;
 	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);

package/dist/client/index.d.mts

@@ -16,7 +16,8 @@ import { OrganizationOptions } from "../plugins/organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../plugins/organization/schema.mjs";
 import { getOrgAdapter } from "../plugins/organization/adapter.mjs";
 import { hasPermission } from "../plugins/organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "../plugins/organization/organization.mjs";
+import { parseRoles } from "../plugins/organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "../plugins/organization/organization.mjs";
 import "../plugins/organization/index.mjs";
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBPrimitive } from "@better-auth/core/db";

package/dist/client/parser.mjs

@@ -1,10 +1,4 @@
 //#region src/client/parser.ts
-const PROTO_POLLUTION_PATTERNS = {
-	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
-	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
-	protoShort: /"__proto__"\s*:/,
-	constructorShort: /"constructor"\s*:/
-};
 const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
 const SPECIAL_VALUES = {
 	true: true,
@@ -40,14 +34,10 @@ function betterJSONParse(value, options = {}) {
 		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
 		return value;
 	}
-	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
-		const matches = pattern.test(trimmed);
-		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
-		return matches;
-	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 	try {
 		const secureReviver = (key, value) => {
 			if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+				if (strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
 				return;
 			}

package/dist/client/vue/index.mjs

@@ -1,3 +1,4 @@
+import { trimTrailingSlashes } from "../../utils/url.mjs";
 import { getClientConfig } from "../config.mjs";
 import { createDynamicPathProxy } from "../proxy.mjs";
 import { useStore } from "./vue-store.mjs";
@@ -16,18 +17,23 @@ function toHeadersInit(headers) {
 }
 function createAuthClient(options) {
 	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $sessionSignal, $fetch, $store, atomListeners } = getClientConfig(options, false);
-	const sessionCacheKey = [
-		"better-auth",
-		"session",
-		options?.baseURL || "inferred",
-		options?.basePath ?? "/api/auth"
-	].join(":");
+	const baseURLKey = options?.baseURL || "inferred";
+	const basePath = options?.basePath ?? "/api/auth";
+	const sessionCacheKey = `better-auth:session:${baseURLKey}:${basePath}`;
+	const sessionPath = trimTrailingSlashes(basePath.startsWith("/") ? basePath : `/${basePath}`);
+	/**
+	* Stays relative without an explicit `baseURL` so the SSR session fetch
+	* forwards the incoming cookies.
+	*
+	* @see https://nuxt.com/docs/4.x/getting-started/data-fetching
+	*/
+	const sessionURL = `${options?.baseURL ? baseURL : sessionPath}/get-session`;
 	const resolvedHooks = {};
 	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[getAtomKey(key)] = () => useStore(value);
 	function useSession(useFetch) {
 		if (useFetch) {
 			const sessionSignal = useStore($sessionSignal);
-			return useFetch(`${baseURL}/get-session`, {
+			return useFetch(sessionURL, {
 				headers: toHeadersInit(options?.fetchOptions?.headers),
 				key: sessionCacheKey,
 				watch: [sessionSignal]

package/dist/context/secret-utils.mjs

@@ -12,12 +12,12 @@ function estimateEntropy(str) {
 }
 function parseSecretsEnv(envValue) {
 	if (!envValue) return null;
-	return envValue.split(",").map((entry) => {
+	return envValue.split(",").map((entry, index) => {
 		entry = entry.trim();
 		const colonIdx = entry.indexOf(":");
-		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry: "${entry}". Expected format: "<version>:<secret>"`);
+		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry at position ${index + 1}. Expected format: "<version>:<secret>"`);
 		const version = parseInt(entry.slice(0, colonIdx), 10);
-		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS: "${entry.slice(0, colonIdx)}". Version must be a non-negative integer.`);
+		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS entry at position ${index + 1}. Version must be a non-negative integer.`);
 		const value = entry.slice(colonIdx + 1).trim();
 		if (!value) throw new BetterAuthError(`Empty secret value for version ${version} in BETTER_AUTH_SECRETS.`);
 		return {

package/dist/db/internal-adapter.mjs

@@ -78,8 +78,18 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
-	async function deleteCachedUserSessions(userId, sessionReferences) {
+	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
+	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
+	async function isRevokedSession(session, revokedBeforeByUser) {
+		if (!secondaryStorage) return false;
+		const revokedBefore = revokedBeforeByUser?.get(session.userId) ?? Number(await secondaryStorage.get(revokedBeforeKey(session.userId)));
+		revokedBeforeByUser?.set(session.userId, revokedBefore);
+		return new Date(session.createdAt).getTime() < revokedBefore;
+	}
+	async function deleteCachedUserSessions(userId, sessionReferences, revokedAt) {
 		if (!secondaryStorage) return;
+		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
+		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
 		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
@@ -97,7 +107,8 @@ const createInternalAdapter = (adapter, ctx) => {
 	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references), { onError(error) {
+		const revokedAt = Date.now();
+		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
 	}
@@ -194,6 +205,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				const now = Date.now();
 				const seenTokens = /* @__PURE__ */ new Set();
 				const sessions = [];
+				const revokedBeforeByUser = /* @__PURE__ */ new Map();
 				for (const { token, expiresAt } of list) {
 					if (expiresAt <= now || seenTokens.has(token)) continue;
 					seenTokens.add(token);
@@ -201,7 +213,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (!data) continue;
 					try {
 						const parsed = typeof data === "string" ? JSON.parse(data) : data;
-						if (!parsed?.session) continue;
+						if (!parsed?.session || await isRevokedSession(parsed.session, revokedBeforeByUser)) continue;
 						sessions.push(parseSessionOutput(ctx.options, {
 							...parsed.session,
 							expiresAt: new Date(parsed.session.expiresAt)
@@ -312,7 +324,10 @@ const createInternalAdapter = (adapter, ctx) => {
 				});
 				const sessionTTL = getTTLSeconds(data.expiresAt, now);
 				if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
-					session: sessionData,
+					session: {
+						...sessionData,
+						createdAt: data.createdAt
+					},
 					user
 				}), sessionTTL);
 				return sessionData;
@@ -336,7 +351,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				if (!sessionStringified && (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase)) return null;
 				if (sessionStringified) {
 					const s = safeJSONParse(sessionStringified);
-					if (!s) return null;
+					if (!s || await isRevokedSession(s.session)) return null;
 					return {
 						session: parseSessionOutput(ctx.options, {
 							...s.session,
@@ -372,11 +387,12 @@ const createInternalAdapter = (adapter, ctx) => {
 			const uniqueTokens = [...new Set(sessionTokens)];
 			const sessionsByToken = /* @__PURE__ */ new Map();
 			const missingTokens = [];
+			const revokedBeforeByUser = /* @__PURE__ */ new Map();
 			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
 				const sessionStringified = await secondaryStorage.get(sessionToken);
 				if (sessionStringified) try {
 					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-					if (!s) continue;
+					if (!s || await isRevokedSession(s.session, revokedBeforeByUser)) continue;
 					const expiresAt = new Date(s.session.expiresAt);
 					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 					const session = {
@@ -590,6 +606,8 @@ const createInternalAdapter = (adapter, ctx) => {
 				join: { ...options?.includeAccounts ? { account: true } : {} }
 			});
 			if (!result) return null;
+			const normalize = (value) => value.normalize("NFC").toLowerCase();
+			if (normalize(result.email) !== normalize(email)) return null;
 			const { account: accounts, ...user } = result;
 			return {
 				user,