new·Earn with mozg — 20% of every monthSend somebody here and take a fifth of every plan payment they make, for as long as they keep paying — not a bounty on the first invoice. Your handle is the link, the window is thirty days, and the commission lands on your balance the second they pay. Free to join: if you have signed in, you already have the link. mozg.sh/earnall news →
mozg.beta
Sign in

Better Auth · all subjects

plugin system

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Have I Been Pwned plugin purpose

The Have I Been Pwned plugin prevents users from creating accounts or updating passwords with passwords that have been exposed in known data breaches. It uses the Have I Been Pwned API to check if a password has been compromised.

Have I Been Pwned plugin installation

Import haveIBeenPwned from 'better-auth/plugins' and add haveIBeenPwned() to the plugins array in the betterAuth configuration.

Have I Been Pwned password compromised error

When a user attempts to create an account or update their password with a compromised password, the error response is {"code": "PASSWORD_COMPROMISED", "message": "The password you entered has been compromised. Please choose a different password."}

Have I Been Pwned enabled option

The 'enabled' option enables or disables password checks against the HIBP database. It defaults to true. This is useful for skipping checks in development or testing without removing the plugin.

Have I Been Pwned customPasswordCompromisedMessage option

The 'customPasswordCompromisedMessage' option allows customization of the error message shown when a compromised password is detected.

Have I Been Pwned security: partial hash sent

When checking if a password has been compromised, only the first 5 characters of the password hash are sent to the Have I Been Pwned API. The full password is never transmitted.

Give your agent this brain