Better Auth 1.7

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 746 lines · 1.5K tokens
  4. Better Auth 1.765 lines · 2.7K tokens
Total314 lines · 12.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 200
  • 203
  • 208
  • 209
  • 214
  • 250
  • 287
  • 294
  • 295
  • 297
  • 307
  • 319
  • 321
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 384
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 601
  • 602
  • 613
  • 614
  • 639
  • 640
  • 653
  • 668
  • 732
  • 770
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1275
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover Better Auth 1.7 configuration, trusted origins, cookies, sessions, email and password flows, social providers, account linking, plugins, storage, and deployment.

Core configuration and origins

  • Declare better-auth and the @better-auth/* adapters, plugins, and integrations released alongside it with a caret range on one shared version, and move to each new Better Auth release as it ships, including a new minor, because upstream supports only its newest release and a fix may never reach an older minor. Before you turn on Magic Link, OAuth Proxy, or another bundled plugin, confirm the lockfile resolves the newest release, since those plugins ship inside the package you already have.
  • Read Better Auth's security advisories page on its GitHub repository and its release notes before each deployment and before enabling a plugin, and don't wait for npm audit to flag the installed release: Better Auth publishes advisories on the repository first, and they can take weeks to reach the GitHub Advisory Database that npm audit reads, or never arrive there.
  • Upgrade every server that shares verification storage, and every OAuth Proxy participant, in one cutover, because a server left on an older release keeps that release's flaws reachable through the shared state.
  • On better-auth 1.7.0 through 1.7.6, which predate the 1.7.7 fix, Magic Link running alongside social or Generic OAuth sign-in with database-backed OAuth state (account.storeStateStrategy: "database", the default