github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-31 10:23:24 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

fix: allow plus signs in relative callback URLs (#1823)

Browse Source
This commit is contained in:
Alex Boyd
2025-03-15 08:02:13 +03:00
committed by GitHub
parent db9290b043
commit a448c517b3
2 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/better-auth/src/api/middlewares/origin-check.test.ts
+18
View File
@@ -73,6 +73,24 @@ describe("Origin Check", async (it) => {
expect(res.data?.user).toBeDefined();
});
it("should allow plus signs in the callback url", async (ctx) => {
const client = createAuthClient({
baseURL: "http://localhost:3000",
fetchOptions: {
customFetchImpl,
headers: {
origin: "https://localhost:3000",
},
},
});
const res = await client.signIn.email({
email: testUser.email,
password: testUser.password,
callbackURL: "/dashboard+page?test=123+456",
});
expect(res.data?.user).toBeDefined();
});
it("should reject callback url with double slash", async (ctx) => {
const client = createAuthClient({
baseURL: "http://localhost:3000",
packages/better-auth/src/api/middlewares/origin-check.ts
+2 -2
View File
@@ -49,7 +49,7 @@ export const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
matchesPattern(url, origin) ||
(url?.startsWith("/") &&
label !== "origin" &&
/^\/(?!\/|\\|%2f|%5c)[\w\-./]*(?:\?[\w\-./=&%]*)?$/.test(url)),
/^\/(?!\/|\\|%2f|%5c)[\w\-.\+/]*(?:\?[\w\-.\+/=&%]*)?$/.test(url)),
);
if (!isTrustedOrigin) {
ctx.context.logger.error(`Invalid ${label}: ${url}`);
@@ -106,7 +106,7 @@ export const originCheck = (
matchesPattern(url, origin) ||
(url?.startsWith("/") &&
label !== "origin" &&
/^\/(?!\/|\\|%2f|%5c)[\w\-./]*(?:\?[\w\-./=&%]*)?$/.test(url)),
/^\/(?!\/|\\|%2f|%5c)[\w\-.\+/]*(?:\?[\w\-.\+/=&%]*)?$/.test(url)),
);
if (!isTrustedOrigin) {
ctx.context.logger.error(`Invalid ${label}: ${url}`);