github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 23:53:17 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

fix: add error handling for id token verification in Apple and Google providers (#8011)

Browse Source 
(cherry picked from commit bcf76b8b74)
This commit is contained in:
Paola Estefanía de Campos
2026-02-18 22:31:37 +08:00
committed by Alex Yang
parent 81f507a92f
commit 90ffd2cffe
2 changed files with 41 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/social-providers/apple.ts
+25 -21
View File
@@ -111,30 +111,34 @@ export const apple = (options: AppleOptions) => {
if (options.verifyIdToken) {
return options.verifyIdToken(token, nonce);
}
const decodedHeader = decodeProtectedHeader(token);
const { kid, alg: jwtAlg } = decodedHeader;
if (!kid || !jwtAlg) return false;
const publicKey = await getApplePublicKey(kid);
const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
algorithms: [jwtAlg],
issuer: "https://appleid.apple.com",
audience:
options.audience && options.audience.length
? options.audience
: options.appBundleIdentifier
? options.appBundleIdentifier
: options.clientId,
maxTokenAge: "1h",
});
["email_verified", "is_private_email"].forEach((field) => {
if (jwtClaims[field] !== undefined) {
jwtClaims[field] = Boolean(jwtClaims[field]);
try {
const decodedHeader = decodeProtectedHeader(token);
const { kid, alg: jwtAlg } = decodedHeader;
if (!kid || !jwtAlg) return false;
const publicKey = await getApplePublicKey(kid);
const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
algorithms: [jwtAlg],
issuer: "https://appleid.apple.com",
audience:
options.audience && options.audience.length
? options.audience
: options.appBundleIdentifier
? options.appBundleIdentifier
: options.clientId,
maxTokenAge: "1h",
});
["email_verified", "is_private_email"].forEach((field) => {
if (jwtClaims[field] !== undefined) {
jwtClaims[field] = Boolean(jwtClaims[field]);
}
});
if (nonce && jwtClaims.nonce !== nonce) {
return false;
}
});
if (nonce && jwtClaims.nonce !== nonce) {
return !!jwtClaims;
} catch {
return false;
}
return !!jwtClaims;
},
refreshAccessToken: options.refreshAccessToken
? options.refreshAccessToken
packages/core/src/social-providers/google.ts
+16 -12
View File
@@ -131,22 +131,26 @@ export const google = (options: GoogleOptions) => {
// Verify JWT integrity
// See https://developers.google.com/identity/sign-in/web/backend-auth#verify-the-integrity-of-the-id-token
const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
if (!kid || !jwtAlg) return false;
try {
const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
if (!kid || !jwtAlg) return false;
const publicKey = await getGooglePublicKey(kid);
const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
algorithms: [jwtAlg],
issuer: ["https://accounts.google.com", "accounts.google.com"],
audience: options.clientId,
maxTokenAge: "1h",
});
const publicKey = await getGooglePublicKey(kid);
const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
algorithms: [jwtAlg],
issuer: ["https://accounts.google.com", "accounts.google.com"],
audience: options.clientId,
maxTokenAge: "1h",
});
if (nonce && jwtClaims.nonce !== nonce) {
if (nonce && jwtClaims.nonce !== nonce) {
return false;
}
return true;
} catch {
return false;
}
return true;
},
async getUserInfo(token) {
if (options.getUserInfo) {