Skip to content

fix(auth): remove dead secret fallback in email-log id salt #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AndersonDesign1 merged 1 commit into from
Jun 22, 2026
Merged

fix(auth): remove dead secret fallback in email-log id salt #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion src/auth/better-auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,10 @@ function getTrustedOrigins() {
}

function getEmailLogId(email: string) {
const secret = process.env.BETTER_AUTH_SECRET ?? "clientra-auth-email-log";
// Salt for a non-reversible log-correlation id (keeps raw emails out of logs).
// In production `rawAuthSecret` is guaranteed set (we throw above otherwise);
// the dev-only constant is an explicit, non-secret salt — never a real key.
const secret = rawAuthSecret ?? "clientra-dev-email-log-salt";

@greptile-apps greptile-apps Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Normalize secrets consistently. rawAuthSecret is trimmed here, but the Better Auth config still receives process.env.BETTER_AUTH_SECRET verbatim through secret. When the environment value has leading or trailing whitespace, production passes the startup check and Better Auth signs with the padded secret, while this helper derives email log IDs from the unpadded value. That silently changes correlation IDs for only this path. Use the same validated value for both the auth config and this helper, or keep both paths on the exact same raw value.

Artifacts

Repro: targeted auth secret normalization harness

  • Contains supporting evidence from the run (text/javascript; charset=utf-8).

Repro: runtime trace showing raw Better Auth secret and trimmed email HMAC salt

  • Keeps the command output available without making the summary code-heavy.

Repro: attempted Vitest harness blocked by local Node engine mismatch

  • Contains supporting evidence from the run (text/typescript; charset=utf-8).

View artifacts

T-Rex Ran code and verified through T-Rex

Prompt To Fix With AI 
This is a comment left during a code review.
Path: src/auth/better-auth.ts
Line: 50

Comment:
**Normalize secrets consistently.** `rawAuthSecret` is trimmed here, but the Better Auth config still receives `process.env.BETTER_AUTH_SECRET` verbatim through `secret`. When the environment value has leading or trailing whitespace, production passes the startup check and Better Auth signs with the padded secret, while this helper derives email log IDs from the unpadded value. That silently changes correlation IDs for only this path. Use the same validated value for both the auth config and this helper, or keep both paths on the exact same raw value.

How can I resolve this? If you propose a fix, please make it concise.


return createHmac("sha256", secret)
.update(email.trim().toLowerCase())
Expand Down
Loading