Repository navigation
fix(auth): never persist social-login provider tokens (0.5.7) - #133
Merged
Merged
Conversation
Better Auth writes accounts.access_token / refresh_token / id_token in plaintext on every social sign-in. Nothing in NIGHTCELL 7 calls a provider API on a player's behalf, so add account create/update hooks that null those fields (and their expiries) before they reach the database. No social provider is configured today (email+password, magic link, passkey), and prod holds 10 credential accounts with zero tokens, so no existing rows need clearing; this keeps it that way if one is added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| }); | ||
|
|
||
| it("leaves a credential account (password hash) alone and adds no token keys", () => { | ||
| const account = { providerId: "credential", accountId: "u1", userId: "u1", password: "salt:hash" }; |
ThreatCrush Security Scan2 finding(s) MEDIUM: 1 | LOW: 1
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fleet sealed-secrets sweep, nightcell7.
Finding:
accounts.access_token / refresh_token / id_tokenare plaintext columns that Better Auth fills on every social sign-in.Audit:
getAccessToken, no provider API calls, no code touchesaccountsoutside Better Auth.nightcell7_comon dev2 shared PG): 10 accounts, allcredential; access/refresh/id tokens = 0/0/0; all 10 passwords are scrypt hashes.sessions.tokenis a server-issued session id;passkeys.public_keyis public).Change:
databaseHooks.account.create/update.beforenull the access, refresh and id tokens and their expiries, so adding a social provider later cannot start storing them. A feature that genuinely needs a provider token must seal it with@profullstack/sealed-secrets.No migration and no data to NULL. Tests: 523/523 vitest, auth + api tsc, eslint clean.
🤖 Generated with Claude Code