Gustavo Valverde and RaeesBhatti
8dffad64a7
feat(auth)!: baseURL is the canonical origin; multi-host via trustedOrigins
...
baseURL conflated two jobs: the stable identity of the auth server and, in its
object form, a per-request host allowlist whose allowedHosts already duplicated
trustedOrigins. Per-request resolution was written three times (HTTP handler,
auth.api path, MCP), so a config shape handled in one was silently unhandled in
the others.
Collapse baseURL to the canonical origin. The hosts a deployment also serves
move to trustedOrigins (static array or per-request function). One boundary
resolver derives the per-request serving origin (the request host when trusted,
else canonical) for every entry point, so cookies and self-referential links
follow the host while identity (OAuth/OIDC issuer, JWT iss/aud, social
redirect_uri, Passkey rpID) stays canonical.
Closes #4151
Closes #8478
Closes #8548
Co-authored-by: RaeesBhatti <10067728+RaeesBhatti@users.noreply.github.com >
2026-06-16 17:42:28 -07:00
Gustavo Valverde
849f6e8aca
chore: sync main to next
2026-06-15 18:30:49 -07:00
Gustavo Valverde and GitHub
1e69725027
docs: clarify stateless Cognito token refresh ( #10092 )
2026-06-15 17:06:35 -07:00
2c8f925c48
docs: generate blog cover images from post titles ( #10032 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-15 09:28:45 -07:00
Gustavo Valverde and GitHub
36f345b1bc
revert: fix: allow headerless get session checks ( #10053 ) ( #10074 )
2026-06-15 00:10:22 -07:00
Gustavo Valverde and GitHub
4475f4a39b
fix(sso): reject OIDC endpoint redirects portably ( #10072 )
2026-06-15 06:56:55 +00:00
Gustavo Valverde and GitHub
6d97c4754c
fix(oauth-provider): challenge invalid userinfo tokens ( #10068 )
2026-06-15 06:27:28 +00:00
Tushar and GitHub
d009daedc7
fix: allow headerless get session checks ( #10053 )
2026-06-15 06:14:34 +00:00
Gustavo Valverde and GitHub
3ef3cfecfa
fix(oauth-provider)!: bind client authentication to the issuing grant ( #10063 )
2026-06-14 20:46:40 -07:00
Gustavo Valverde and GitHub
aedcb974f0
feat(oauth-provider): add DPoP support ( #10039 )
2026-06-14 18:28:21 -07:00
Gustavo Valverde and GitHub
0143d69195
feat(oauth-provider): support protected dynamic client registration ( #10037 )
2026-06-14 15:00:17 -07:00
Gustavo Valverde and GitHub
050ef2dfcf
feat(oauth-provider): add extension surface ( #10030 )
2026-06-14 11:37:28 -07:00
Gustavo Valverde and GitHub
2fd3d58500
feat(oauth-provider): consistent and audience-scoped token introspection ( #10045 )
2026-06-13 12:58:25 -07:00
Maxwell and GitHub
581f8271fb
fix(last-login-method): include domain when clearing cross-subdomain cookies ( #9319 )
2026-06-13 11:52:33 +00:00
Taesu and GitHub
ad35eadd13
fix(one-tap)!: require client id for audience validation ( #10036 )
2026-06-13 01:05:01 +00:00
Gustavo Valverde
9dcc0318da
chore: sync main to next
2026-06-12 17:34:58 -07:00
b4b02660c7
feat(device-authorization): allow pre-binding device codes to a user ( #9995 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-06-12 22:57:37 +00:00
c1a8a64c14
fix(open-api): generate valid OpenAPI schemas for client generators ( #9555 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-06-12 22:24:56 +00:00
Gustavo Valverde and GitHub
6fe9faab65
refactor!: remove deprecated oidc-provider plugin ( #10031 )
2026-06-12 21:45:19 +00:00
Gustavo Valverde
c40989def2
fix: address sync review comments
2026-06-12 10:40:36 -07:00
Gustavo Valverde
6f5c707459
chore: sync main to next
2026-06-12 10:25:24 -07:00
d2a79bae79
feat(oauth-provider)!: model OAuth protected resources explicitly ( #9648 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:08:43 -07:00
48070ada8b
feat(sso): support additionalFields on ssoProvider ( #9445 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 10:00:55 -07:00
729fd84034
fix(oauth-provider): canonicalize signed OAuth query params ( #9941 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 15:17:00 +00:00
34558bc52b
feat(session): support JWKS-backed JWT session cookie cache ( #8931 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-12 15:03:33 +00:00
Taesu and GitHub
def1624a13
docs(changelog): avoid false contributor avatars ( #10019 )
2026-06-12 01:18:52 -07:00
Gustavo Valverde and GitHub
e53582ce55
feat(mcp)!: ship MCP as its own package built on the OAuth provider ( #9992 )
2026-06-11 21:34:38 -07:00
Gustavo Valverde
5ce8d4cb55
chore: keep beta Apple docs component available
2026-06-11 20:03:44 -07:00
Gustavo Valverde
d2949a8700
Merge remote-tracking branch 'origin/main' into chore/sync-main-to-next-20260611
2026-06-11 18:45:33 -07:00
Gustavo Valverde
7a55ae4f52
Merge remote-tracking branch 'origin/next' into chore/sync-main-to-next-20260611
...
# Conflicts:
# .changeset/accept-invitation-team-capacity.md
# .changeset/adapters-native-increment-one.md
# .changeset/api-key-atomic-quota.md
# .changeset/delete-account-token-single-use.md
# .changeset/device-code-single-use.md
# .changeset/electron-code-single-use.md
# .changeset/email-otp-attempts-atomic.md
# .changeset/increment-one-primitive.md
# .changeset/memory-adapter-transaction-isolation.md
# .changeset/one-time-token-single-use.md
# .changeset/passkey-ceremony-binding.md
# .changeset/password-reset-token-single-use.md
# .changeset/phone-otp-attempts-atomic.md
# .changeset/rate-limit-atomic-consume.md
# .changeset/redis-increment.md
# .changeset/reserve-verification-value.md
# .changeset/saml-replay-reserve.md
# .changeset/siwe-nonce-single-use.md
# .changeset/two-factor-challenge-single-use.md
# .changeset/twofactor-otp-attempts-atomic.md
# packages/api-key/src/adapter.ts
# packages/api-key/src/api-key.test.ts
# packages/better-auth/src/api/rate-limiter/index.ts
# packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts
# packages/better-auth/src/db/internal-adapter.ts
# packages/better-auth/src/plugins/device-authorization/routes.ts
# packages/better-auth/src/plugins/organization/adapter.ts
# packages/better-auth/src/plugins/organization/routes/crud-invites.ts
# packages/better-auth/src/plugins/organization/routes/crud-members.ts
# packages/better-auth/src/plugins/organization/routes/crud-team.ts
# packages/better-auth/src/plugins/organization/team.test.ts
# packages/better-auth/src/plugins/phone-number/routes.ts
# packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
# packages/core/src/db/adapter/factory.ts
# packages/core/src/db/adapter/index.ts
# packages/core/src/db/type.ts
# packages/core/src/types/context.ts
# packages/core/src/types/init-options.ts
# packages/drizzle-adapter/src/drizzle-adapter.test.ts
# packages/drizzle-adapter/src/drizzle-adapter.ts
# packages/electron/test/electron.test.ts
# packages/kysely-adapter/src/kysely-adapter.ts
# packages/memory-adapter/src/memory-adapter.ts
# packages/mongo-adapter/src/mongodb-adapter.test.ts
# packages/mongo-adapter/src/mongodb-adapter.ts
# packages/passkey/src/routes.ts
# packages/prisma-adapter/src/prisma-adapter.ts
# packages/redis-storage/src/redis-storage.ts
# packages/redis-storage/test/redis-storage.test.ts
# packages/sso/src/saml.test.ts
2026-06-11 18:45:17 -07:00
Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
ZerGo0 and GitHub
029cbdc072
docs: update Apple client secret JWT guidance ( #9938 )
2026-06-11 17:54:44 -07:00
Gustavo Valverde and GitHub
86ccb5de91
feat(auth)!: harden atomic state transitions ( #10000 )
2026-06-12 00:46:44 +00:00
Jordan Kahtava and GitHub
44a24ed948
docs: highlighted emailVerified requirement on manually inserted users ( #9999 )
2026-06-11 17:45:37 -07:00
Gautam Manchandani and GitHub
bf39cbf13f
feat(phone-number): add server-side OTP consumption API ( #9766 )
2026-06-11 16:58:16 -07:00
Taesu and GitHub
b36c38f984
feat(captcha)!: support wildcard endpoint matching ( #10004 )
2026-06-11 23:47:25 +00:00
Damien Maspero and GitHub
e468ff37ce
docs: update Node.js built-in SQLite status to Release Candidate ( #9914 )
2026-06-10 23:13:39 -07:00
Taesu and GitHub
3e99e6c77e
fix(admin): create credential account in setUserPassword when missing ( #9482 )
2026-06-11 05:36:55 +00:00
6987c628f1
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports ( #9834 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 01:06:43 +00:00
Gustavo Valverde
d7bba8ee33
Merge origin/next into chore/sync-main-to-next
2026-06-10 11:34:38 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
Eric Luce and GitHub
82dbc9b8bf
docs: add ProofKit FileMaker adapter ( #9980 )
2026-06-10 11:26:02 -07:00
Prakash Kumar and GitHub
128bc34572
docs: add horizontal scrolling to landing page code block ( #9975 )
2026-06-09 23:22:24 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
87e7aa5e0f
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up ( #9973 )
2026-06-10 01:43:41 +00:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Paola Estefanía de Campos and GitHub
afcb4dd7f3
docs(two-factor): document newSession is null during 2FA challenge ( #9957 )
2026-06-09 13:15:00 -07:00
Gustavo ValverdeandRaeesBhatti
TusharandGitHub
MaxwellandGitHub
TaesuandGitHub
ZerGo0andGitHub
Jordan KahtavaandGitHub
Damien MasperoandGitHub
Eric LuceandGitHub
Prakash KumarandGitHub
Paola Estefanía de CamposandGitHub