Skip to content

fix(oauth2): compare accountId as forced string to prevent duplicates#3815

Closed
cemreinanc wants to merge 2 commits into
better-auth:canaryfrom
cemreinanc:fix/duplicate-oauth-accounts
Closed

fix(oauth2): compare accountId as forced string to prevent duplicates#3815
cemreinanc wants to merge 2 commits into
better-auth:canaryfrom
cemreinanc:fix/duplicate-oauth-accounts

Conversation

@cemreinanc
Copy link
Copy Markdown

@cemreinanc cemreinanc commented Aug 5, 2025

in oauth2/link-account.ts file: accountId returns as a string from database but other one returns as a number from the endpoint. So they dont align and cause hasBeenLinked to be undefined.
in line 46 comparing like this a.accountId === String(account.accountId) seems like solved the issue.

Closes #3814


Summary by cubic

Fixed an issue where OAuth account linking could create duplicate accounts by ensuring accountId is always compared as a string.

@cemreinanc cemreinanc requested a review from Bekacru as a code owner August 5, 2025 21:00
@vercel
Copy link
Copy Markdown

vercel Bot commented Aug 5, 2025

@cemreinanc is attempting to deploy a commit to the better-auth Team on Vercel.

A member of the Team first needs to authorize it.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Aug 5, 2025

Open in StackBlitz

better-auth

npm i https://pkg.pr.new/better-auth/better-auth@3815

@better-auth/cli

npm i https://pkg.pr.new/better-auth/better-auth/@better-auth/cli@3815

@better-auth/expo

npm i https://pkg.pr.new/better-auth/better-auth/@better-auth/expo@3815

@better-auth/sso

npm i https://pkg.pr.new/better-auth/better-auth/@better-auth/sso@3815

@better-auth/stripe

npm i https://pkg.pr.new/better-auth/better-auth/@better-auth/stripe@3815

commit: 6143364

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cubic analysis

No issues found across 1 file. Review in cubic

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the real case causing the accountId to be a number? Could there be a deeper issue behind this? since the type annotation around is all string

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I realized that issue is from https://github.com/better-auth/better-auth/pull/3816/files#diff-16e9f39c92f582849ffc6ba9be9b14f8f04a8137bf025e3c876159c01d254564R307 if getUserInfo returns the number. we don't give any error about this

@Bekacru
Copy link
Copy Markdown
Contributor

Bekacru commented Aug 6, 2025

closed in favor of #3816

@Bekacru Bekacru closed this Aug 6, 2025
@better-auth better-auth locked as resolved and limited conversation to collaborators Apr 1, 2026
@bytaesu bytaesu added the locked Locked conversations after being closed for 7 days label Apr 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

locked Locked conversations after being closed for 7 days

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Duplicated oauth accounts because of type mismatch

5 participants