我是否被泄露过

Have I Been Pwned 插件通过防止使用已在已知数据泄露中曝光的密码来保护用户账户。它使用 Have I Been Pwned API 来检查密码是否已被泄露。

【The Have I Been Pwned plugin helps protect user accounts by preventing the use of passwords that have been exposed in known data breaches. It uses the Have I Been Pwned API to check if a password has been compromised.】

安装

【Installation】

将插件添加到你的 auth 配置中

【Add the plugin to your auth config】

import { betterAuth } from "better-auth"
import { haveIBeenPwned } from "better-auth/plugins"

export const auth = betterAuth({
    plugins: [
        haveIBeenPwned()
    ]
})

用法

【Usage】

当用户尝试使用被泄露的密码创建账户或更新密码时，他们将收到以下默认错误提示：

【When a user attempts to create an account or update their password with a compromised password, they'll receive the following default error:】

{
  "code": "PASSWORD_COMPROMISED",
  "message": "Password is compromised"
}

配置

【Config】

你可以自定义错误消息：

【You can customize the error message:】

haveIBeenPwned({
    customPasswordCompromisedMessage: "Please choose a more secure password."
})

安全注意事项

【Security Notes】

• 密码哈希的前五个字符才会被发送到 API
• 完整密码从不被传输
• 提供额外的账户安全层