- SECURITY FIX: Fixes incorrect session property
authProvider: password
of anonymous users. When signing up an anonymous user, the session fieldcreatedWith
indicates incorrectly that the session has been created using username and password withauthProvider: password
, instead of an anonymous sign-up withauthProvider: anonymous
. This fixes the issue by setting the correctauthProvider: anonymous
for future sign-ups of anonymous users. This fix does not fix incorrectauthProvider: password
for existing sessions of anonymous users. Consider this if your app logic depends on theauthProvider
field. (Corey Baker) GHSA-23r4-5mxp-c7g5