diff --git a/packages/better-auth/src/plugins/mcp/authorize.ts b/packages/better-auth/src/plugins/mcp/authorize.ts index e876346aad..732057c4cb 100644 --- a/packages/better-auth/src/plugins/mcp/authorize.ts +++ b/packages/better-auth/src/plugins/mcp/authorize.ts @@ -10,7 +10,7 @@ import type { } from "../oidc-provider/types"; function redirectErrorURL(url: string, error: string, description: string) { - return `${ + return `${url}${ url.includes("?") ? "&" : "?" }error=${error}&error_description=${description}`; } diff --git a/packages/better-auth/src/plugins/oidc-provider/authorize.ts b/packages/better-auth/src/plugins/oidc-provider/authorize.ts index 77b1f314b8..e3f14af468 100644 --- a/packages/better-auth/src/plugins/oidc-provider/authorize.ts +++ b/packages/better-auth/src/plugins/oidc-provider/authorize.ts @@ -7,7 +7,7 @@ import type { AuthorizationQuery, OIDCOptions } from "./types"; import { parsePrompt } from "./utils/prompt"; function formatErrorURL(url: string, error: string, description: string) { - return `${ + return `${url}${ url.includes("?") ? "&" : "?" }error=${error}&error_description=${description}`; } diff --git a/packages/sso/src/oidc.test.ts b/packages/sso/src/oidc.test.ts index 0596ab1f62..f8caec02f8 100644 --- a/packages/sso/src/oidc.test.ts +++ b/packages/sso/src/oidc.test.ts @@ -505,9 +505,7 @@ describe("SSO disable implicit sign in", async () => { "redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fsso%2Fcallback%2Ftest", ); const { callbackURL } = await simulateOAuthFlow(res.url, headers); - expect(callbackURL).toContain( - "/api/auth/error/error?error=signup disabled", - ); + expect(callbackURL).toContain("/api/auth/error?error=signup disabled"); }); it("should create user with SSO provider when sign ups are disabled but sign up is requested", async () => { diff --git a/packages/sso/src/routes/sso.ts b/packages/sso/src/routes/sso.ts index 98b901dd53..c725d8146d 100644 --- a/packages/sso/src/routes/sso.ts +++ b/packages/sso/src/routes/sso.ts @@ -1467,7 +1467,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=provider not found`, + }?error=invalid_provider&error_description=provider not found`, ); } @@ -1486,7 +1486,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=provider not found`, + }?error=invalid_provider&error_description=provider not found`, ); } @@ -1513,7 +1513,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=token_endpoint_not_found`, + }?error=invalid_provider&error_description=token_endpoint_not_found`, ); } @@ -1544,7 +1544,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=token_response_not_found`, + }?error=invalid_provider&error_description=token_response_not_found`, ); } let userInfo: { @@ -1561,7 +1561,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=jwks_endpoint_not_found`, + }?error=invalid_provider&error_description=jwks_endpoint_not_found`, ); } const verified = await validateToken( @@ -1575,14 +1575,14 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=token_not_verified`, + }?error=invalid_provider&error_description=token_not_verified`, ); } if (verified.payload.iss !== provider.issuer) { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=issuer_mismatch`, + }?error=invalid_provider&error_description=issuer_mismatch`, ); } @@ -1615,7 +1615,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=user_info_endpoint_not_found`, + }?error=invalid_provider&error_description=user_info_endpoint_not_found`, ); } const userInfoResponse = await betterFetch<{ @@ -1633,7 +1633,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=${ + }?error=invalid_provider&error_description=${ userInfoResponse.error.message }`, ); @@ -1645,7 +1645,7 @@ export const callbackSSO = (options?: SSOOptions) => { throw ctx.redirect( `${ errorURL || callbackURL - }/error?error=invalid_provider&error_description=missing_user_info`, + }?error=invalid_provider&error_description=missing_user_info`, ); } const isTrustedProvider = @@ -1679,9 +1679,7 @@ export const callbackSSO = (options?: SSOOptions) => { isTrustedProvider, }); if (linked.error) { - throw ctx.redirect( - `${errorURL || callbackURL}/error?error=${linked.error}`, - ); + throw ctx.redirect(`${errorURL || callbackURL}?error=${linked.error}`); } const { session, user } = linked.data!;