Email enumeration protection with requireEmailVerification
When requireEmailVerification is enabled, signing up with an existing email returns a success response (HTTP 200) instead of an error to prevent user enumeration.
Better Auth · Authentication · all subjects
email verification
6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Email enumeration protection activation conditions
Email enumeration protection is only active when the sign-up response does not include a session token, which occurs when requireEmailVerification is true or autoSignIn is false. With the default configuration, the endpoint returns a 422 error for existing emails.
customSyntheticUser for email enumeration protection
When using plugins that add fields to the user table (such as admin, two-factor, phone-number), use the customSyntheticUser option to build the complete synthetic user object for email enumeration protection. The callback receives coreFields (name, email, emailVerified, image, createdAt, updatedAt), additionalFields (your user.additionalFields with defaults applied), and id (generated user ID). Assemble them in the same order as your database schema: core fields → plugin fields → additional fields → id.
Better Auth verification table schema fields
Better Auth's verification table has the following fields: id (string, primary key), identifier (string), value (string), expiresAt (Date), createdAt (Date), updatedAt (Date).
SQLite verifications table schema
The verifications table contains: id (text, primary key), identifier (text, not null), value (text, not null), expiresAt (integer/timestamp_ms, not null), createdAt (integer/timestamp_ms, default current unix epoch milliseconds, not null), updatedAt (integer/timestamp_ms, default current unix epoch milliseconds, updated on changes, not null). An index exists on identifier.
Email verification uses verifications table
Email verification data is stored in a separate verifications table with identifier and value fields, used for storing verification tokens with expiration.