v1.0-RC — Better Auth Migration
Breaking Changes
-
OAuth callback URL changed. The redirect URI format is now:
{BASE_URL}/api/auth/oauth2/callback/{provider-id}The old format (
/api/auth/callback/oauth2) no longer works. Update your OAuth provider's redirect URI — the exact URL is shown in Settings → OAuth Providers. -
Database columns renamed to camelCase. This migration runs automatically on upgrade. Back up your database before upgrading.
-
All active sessions are invalidated on upgrade (the sessions table is recreated). All users will need to log in again.
-
Rate limiting env vars changed.
LOGIN_MAX_ATTEMPTS/LOGIN_WINDOW_MS/LOGIN_BLOCK_MSnow only apply to the password-change endpoint. Auth rate limiting uses newAUTH_RATE_LIMIT_*variables (see below).
New Features
- UI-based OAuth provider management — Add, edit, enable/disable, and delete OAuth/OIDC providers from Settings → OAuth Providers without restarting the container
- Multiple OAuth providers — Configure as many providers as needed (previously limited to one via env vars)
- Server-side sessions — Replaces JWT-based sessions for better security (immediate role change enforcement, session revocation)
- OAuth token encryption — OAuth access/refresh/id tokens are encrypted at rest with AES-256-GCM
- Login audit logging — Successful logins are now recorded in the audit log
- Account unlinking — Users can unlink OAuth accounts from the Profile page
Security Fixes
- Tightened login rate limit from 200 req/10s to 5 req/60s
- Password changes now sync to Better Auth's credential store (old password stops working immediately)
- OAuth client secrets are redacted in all server action responses
- Added
trustHostconfig (defaultfalse) to prevent Host header poisoning - Audit logging added to OAuth provider update/delete operations
- Encryption module failure now refuses to store plaintext secrets instead of silently falling back
New Environment Variables
| Variable | Description | Default |
|---|---|---|
AUTH_RATE_LIMIT_ENABLED
| Enable auth rate limiting | true
|
AUTH_RATE_LIMIT_WINDOW
| Rate limit window (seconds) | 60
|
AUTH_RATE_LIMIT_MAX
| Max requests per window | 5
|
AUTH_TRUST_HOST
| Trust Host header (only behind rewriting proxies) | false
|
Upgrade Steps
- Back up your database (
data/caddy-proxy-manager.db) - Pull the new image and restart:
docker compose pull && docker compose up -d - Migrations run automatically — verify the app starts correctly
- Go to Settings → OAuth Providers and copy the new callback URL
- Update the redirect URI in your OAuth provider's configuration
- Test OAuth login