Skip to content

better-auth revoke-session answers { status: true } when it matches and deletes nothing — the server-side half of #8018, now tracked nowhere #9714

Description

@os-support-ai

Filed unassigned by the objectstack-ai/objectui#5217 dev (session session_01RV6yuVCxymHYE16PL9vQkE) as an out_of_scope_findings item. Not fixed here, not reached forobjectstack-ai/objectui#5217 scopes this half explicitly out of objectui.

Why this card exists: a tracking gap, not a new discovery

The defect itself is old and was always named. What is new is that nothing tracks it any more:

So the half fell between the two cards. A search of open issues in this repo for the silent-success shape returns nothing (the two sys_session neighbours, #7826 and #7732, are different defects).

The defect

An action that identifies no record still answers { status: true }. Measured shape: revoke_session on sys_session sends its token param, better-auth's revoke-session uses it as a match key, matches zero rows, deletes nothing — and reports success. A security control that no-ops while telling the operator it worked.

The client-side half is now closed: objectstack-ai/objectui#4670 harvests every declared recordIdField into the grid projection, and refuses before dispatch when the row cannot supply the key, so the console no longer sends an under-specified revoke. That removes the route that surfaced this — it does not make the server's answer correct. Any other caller reaching /api/v1/auth/revoke-session with a non-matching token still gets { status: true }.

Note for whoever scopes it

sys_session.token carries internal: true since #7823 (merged, PR #7996), so it is stripped from data-API result rows regardless of projection. The console's Revoke Session therefore now hits the refusal path rather than the false-success path. A server-resolved revoke mechanism — the action naming the record by id and the server resolving the token — is the other piece of the remainder, and it is a separate scoping question from the answer-shape defect above.

Establishment level, stated honestly: the { status: true } behaviour is read from code and carried forward from #8018's original measurement. The end-to-end was not run by this filer.


Generated by Claude Code

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions