Better Auth•6d ago

HaveIBeenPwned creates user anyway

I tried integrating the new haveIBeenPwned() plugin and found out that users are created, even if the password is marked as pwned.

{code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD", message: "The password you entered has been compromised. Please choose a different password.", status: 400, statusText: "Bad Request"}

1. code = message? (I think it's good to customize the code in addition to the message for localization purposes) 2. The user is created in the database anyways

Solution:

npm i https://pkg.pr.new/better-auth/better-auth@2253

Jump to solution

13 Replies

Ping•6d ago

I'll look into this.

KiNFiSH•6d ago

@Jan-Nicklas can u able to login after the error ?

Jan-NicklasOP•6d ago

@KiNFiSH No. I just checked and the account is npt created, but the user is. So you can't login but also can't create a user with same email/username

Davis•6d ago

Ya got the same issue

KiNFiSH•6d ago

fixed lemme send test npm build

Solution

KiNFiSH•6d ago

npm i https://pkg.pr.new/better-auth/better-auth@2253

KiNFiSH•6d ago

check this one and lemme know if it works

Jan-NicklasOP•6d ago

That works, no entry is created in the user or verification table 👍

KiNFiSH•6d ago

will merge it. thanks

Jan-NicklasOP•6d ago

I also created a PR for the error code: https://github.com/better-auth/better-auth/pull/2255

GitHub

fix(haveIBeenPwned): Meaningful error code by JE4GLE · Pull Reques...

In my humble opinion, THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD is not a valid error code. Error codes should be short and are not required the be understand ...

KiNFiSH•6d ago

It is already been fixed along side with that Thanks for the help

Jan-NicklasOP•6d ago

@KiNFiSH Where is the fix for the error code? Your PR I just tested returns:

{
    code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD",
    message: "My custom message",
    status: 400,
    statusText: "Bad Request"
}

{
    code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD",
    message: "My custom message",
    status: 400,
    statusText: "Bad Request"
}

bekacru•6d ago

try 1.2.7-beta.1 should fix both

Gaming

Programming

HaveIBeenPwned creates user anyway

Did you find this page helpful?