Re-applies main's #9821 onto next's rebuilt SAML routes. next kept the
createSP/createIdP helpers and consolidated saml-pipeline, so the fix is
expressed there rather than in the inline construction main patched.
- normalizePem trims leading indentation from PEM private keys so samlify
2.13.1 (OpenSSL 3 native parsing) loads keys pasted with surrounding
whitespace; applied in the SP/IdP helpers.
- processSAMLResponse reads identity attributes through an attr() accessor
that collapses samlify 2.13's string | string[] attribute values to the
single-valued identity fields.
- the SLO LogoutResponse is built by passing the parsed request to samlify
(filling InResponseTo/Issuer/IssueInstant/Destination/StatusCode) instead
of manual template string replacement.
The samlify ^2.13.1 and fast-xml-parser ^5.8.0 bumps land via the merge.
saml.test.ts unions next's SAML suites with #9821's key-normalization and
SLO regression tests (120 passing).
Re-applies five main fixes onto next's rebuilt SSO routes. next's refactor
kept the supporting helpers (the SSRF host check, the SAMLSessionRecord
token field) but dropped the call sites, so the merge left them present yet
unused. This wires them back.
- #9574: registerSSOProvider and updateSSOProvider now run
validateSkipDiscoveryEndpoints on user-supplied OIDC endpoints, rejecting
private/link-local hosts (for example 169.254.169.254). The merge included
the helper but never called it, leaving advisory GHSA-5rr4-8452-hf4v open
on next. Validation runs even without skipDiscovery.
- #9220: registering an SSO provider requires an organization owner/admin
role when the organization plugin is active, blocking a low-privilege
member from registering a malicious IdP.
- #9818: SAML Single Logout revokes the session by token; the SAML session
record now carries the session token.
- #9722: the OIDC callback error redirect encodes the error value.
- #9702: a before-callback hook rejection in the OIDC and SAML callbacks
redirects to the per-flow errorURL with the hook's code, instead of
surfacing a raw response.
Two stale IDP-bounce assertions are updated to next's migrated state-error
vocabulary (state_not_found). All SSO regression suites pass (SSRF,
org-admin, SLO, hook-rejection, encoding).
(cherry picked from commit c3b238f71a6f66914f12db5f615504e2cf855bfc)
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577.
- keep next package versions at 1.7.0-beta.1
- keep both changelog streams by inserting the stable 1.6.5, 1.6.6, and 1.6.7 sections below the 1.7.0-beta entries
- keep the cimd and dash deps on demo/nextjs (next-only); regenerate pnpm-lock.yaml
- resolve TODO(sync-from-main-9226) in oauth-provider authorize.ts: findRegisteredRedirectUri now uses isLoopbackIP from @better-auth/core/utils/host to cover the full 127.0.0.0/8 range per RFC 8252 §7.3
- drop the unused saml import that main's #9262 added to sso/src/routes/sso.ts; next already migrated to saml-pipeline
- Add empty string fallback before .toLowerCase() to prevent TypeError
when both mapped email attribute and extract.nameID are falsy
- Use validated samlRedirectUrl instead of raw callbackUrl in error
redirect to maintain open-redirect and loop-protection guarantees
Use main's saml-pipeline.ts for SAML response processing, replacing
~1000 lines of duplicated inline code in sso.ts. Port the four
security fixes from #9055 into the pipeline:
- Fix InResponseTo field path (extract.response?.inResponseTo)
- Add Audience Restriction validation
- Fix SessionIndex stored as string, not object
- Fix allowIdpInitiated default to false
Delegate to validateInResponseTo/validateAudience from
response-validation.ts instead of reimplementing inline.
Graft private_key_jwt (RFC 7523) support from #8836 onto main's
pipeline-based sso.ts.
Gustavo Valverde
Bereket EngidaandGitHub
Taesu
Craig (Michael) ThompsonandGitHub
Jonathan SaminesandGitHub
Martin RädlingerandGitHub
David FrankelandGitHub
Alex YangandGitHub
