Better Auth•6mo ago

HaveIBeenPwned creates user anyway

I tried integrating the new haveIBeenPwned() plugin and found out that users are created, even if the password is marked as pwned.

{code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD", message: "The password you entered has been compromised. Please choose a different password.", status: 400, statusText: "Bad Request"}

1. code = message? (I think it's good to customize the code in addition to the message for localization purposes) 2. The user is created in the database anyways

Solution:

npm i https://pkg.pr.new/better-auth/better-auth@2253

Jump to solution

13 Replies

Ping•6mo ago

I'll look into this.

KiNFiSH•6mo ago

@Jan-Nicklas can u able to login after the error ?

JanOP•6mo ago

@KiNFiSH No. I just checked and the account is npt created, but the user is. So you can't login but also can't create a user with same email/username

Davis•6mo ago

Ya got the same issue

KiNFiSH•6mo ago

fixed lemme send test npm build

Solution

KiNFiSH•6mo ago

npm i https://pkg.pr.new/better-auth/better-auth@2253

KiNFiSH•6mo ago

check this one and lemme know if it works

JanOP•6mo ago

That works, no entry is created in the user or verification table 👍

KiNFiSH•6mo ago

will merge it. thanks

JanOP•6mo ago

I also created a PR for the error code: https://github.com/better-auth/better-auth/pull/2255

GitHub

fix(haveIBeenPwned): Meaningful error code by JE4GLE · Pull Reques...

In my humble opinion, THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD is not a valid error code. Error codes should be short and are not required the be understand ...

KiNFiSH•6mo ago

It is already been fixed along side with that Thanks for the help

JanOP•6mo ago

@KiNFiSH Where is the fix for the error code? Your PR I just tested returns:

{
    code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD",
    message: "My custom message",
    status: 400,
    statusText: "Bad Request"
}

{
    code: "THE_PASSWORD_YOU_ENTERED_HAS_BEEN_COMPROMISED_PLEASE_CHOOSE_A_DIFFERENT_PASSWORD",
    message: "My custom message",
    status: 400,
    statusText: "Bad Request"
}

bekacru•6mo ago

try 1.2.7-beta.1 should fix both

Gaming

Programming

HaveIBeenPwned creates user anyway

Did you find this page helpful?