Skip to content

v1.8.6 — Signup lockdown fix

Latest
Latest

Choose a tag to compare

View all tags
@edgarjc edgarjc released this 06 Sep 05:00
v1.8.6
a23dc30
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • ALLOW_SIGNUPS=false did not actually stop account creation. The setting was checked on the signup endpoint, but the auth proxy exposes Better Auth's own /api/auth/sign-up/email route, and that was reachable regardless — a deploy with signups closed still accepted new accounts, sessions and verification emails. Account creation is now gated in one place: with the setting off, an account can only be created when a pending, unexpired invitation exists for that address, so invited clients are unaffected. (#68)

Fixes

  • Analytics were undercounting signups. /signup, /accept-invite and /forgot-password are prerendered, so they were baked at build time with an empty tracker list and never reported. They now resolve trackers at request time, which also means the published image reports nowhere by default. (#65, #66)
  • Identifiers are stripped from analytics payloads before sending — project ids, org slugs, signing tokens, query strings and page titles were all being transmitted. (#65)

Upgrading

No action needed. If you run with ALLOW_SIGNUPS=false, check your user table for accounts created while the setting was ineffective.

Full changelog: v1.8.5...v1.8.6

Assets 2
Loading