BA

Better Auth•9mo ago

djang0

Why is the accessToken not encrypted by default?

Hi, why is the accessToken in accountaccount not encrypted by default e.g for discord in our persistence?
And what's the easiest way to encrypt/decrypt it? Creating a custom plugin would do the job, I guess? thanks !

Solution

After discussing with @bekacru we'll be implementing this built-in.
Right now it could be possible via custom plugin - but I'm not 100% certain on this.

Our future plans (roughly) are:

• Encrypt accessToken by default
• Provide auth.$context.decryptAccessTokenauth.$context.decryptAccessToken or something like that.
• Provide options to configure access token encryption under options.account.accessTokenoptions.account.accessToken
  
  • options.account.accessToken.disableEncryptionoptions.account.accessToken.disableEncryption
    • boolean
  • options.account.accessToken.encryptoptions.account.accessToken.encrypt
    • fn to encrypt
  • options.account.accessToken.decryptoptions.account.accessToken.decrypt
    • fn to decrypt
  • potentially others.

Jump to solution