Safer billing returns and simpler authentication
Pro Prisma and Pro Drizzle now restrict payment return URLs, improve existing-email errors and remove unused username authentication without changing existing databases.
Both starter kits now validate every caller-provided Stripe return URL before creating a checkout or customer portal session. The authentication error map also recognizes Better Auth's newer existing-email error code instead of falling back to a generic message. The unused Better Auth username plugin has also been removed while its nullable database field remains intact for upgrade compatibility.
What changed
- Restrict checkout success and cancellation URLs to the configured application origin.
- Apply the same origin check to Stripe customer portal return URLs.
- Reject external, protocol-relative, malformed and origin-confusion URLs.
- Preserve valid same-origin paths, query strings and hashes.
- Map
USER_ALREADY_EXISTS_USE_ANOTHER_EMAILto an actionable message that tells the user to choose another email address. - Remove the unused username sign-in endpoints without rewriting existing migrations or requiring a database change.
Verification
Focused tests cover valid same-origin returns together with external, protocol-relative, JavaScript, malformed and origin-confusion values. The full unit suites, TypeScript checks, MCP build and Webpack production builds pass for both editions. The checkout and cancellation flow was also verified on the production demo with Stripe test mode.
Existing projects
No database migration or environment change is required. The existing nullable username field can remain in project databases; the application no longer registers username authentication. Existing projects can adopt the shared payment redirect schema at the checkout and portal call sites, then add the Better Auth error code to their authentication error map.
Review the billing guidance for Pro Prisma or Pro Drizzle.