github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #7700] oauth-provider add support for prompt=none #10879

New Issue
Closed
opened 2026-04-13 07:15:08 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-13 07:15:08 -05:00
Owner
Copy Link

Originally created by @dvanmali on GitHub (Jan 30, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7700

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

PR #7665 added the enum for prompt="none" into the parameter list however the prompt is not actually supported internally.

Describe the solution you'd like

Add support for prompt="none" for the oauth-provider plugin.

Describe alternatives you've considered

na

Additional context

Currently, there is no advertisement of the "none" prompt in metadata field prompt_values_supported so it's a feature request (not an issue).

Originally created by @dvanmali on GitHub (Jan 30, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7700 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. PR #7665 added the enum for `prompt="none"` into the parameter list however the prompt is not actually supported internally. ### Describe the solution you'd like Add support for `prompt="none"` for the oauth-provider plugin. ### Describe alternatives you've considered na ### Additional context Currently, there is no advertisement of the "none" prompt in metadata field `prompt_values_supported` so it's a feature request (not an issue).
GiteaMirror added the locked label 2026-04-13 07:15:08 -05:00
GiteaMirror commented 2026-04-13 07:15:11 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 30, 2026):

The feature request to add support for prompt="none" in the oauth-provider plugin is noted. Currently, the implementation has been pointed out as lacking internal support for this parameter despite the enum being added in a previous PR [1]. Adding support for prompt="none" would allow for silent login flows and would align the plugin with the OIDC standard [2].

Next steps would involve investigating the necessary changes to implement this feature in accordance to the standards and any related updates in the ongoing development process.

If you'd like to continue this discussion or have further inquiries about the implementation, please tag @better-auth-agent for additional assistance! What are your thoughts on the implementation challenges with this feature?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3822047468 --> @better-auth-agent[bot] commented on GitHub (Jan 30, 2026): The feature request to add support for `prompt="none"` in the oauth-provider plugin is noted. Currently, the implementation has been pointed out as lacking internal support for this parameter despite the enum being added in a previous PR [[1]](https://github.com/better-auth/better-auth/pull/7092). Adding support for `prompt="none"` would allow for silent login flows and would align the plugin with the OIDC standard [[2]](https://github.com/better-auth/better-auth/pull/4163). Next steps would involve investigating the necessary changes to implement this feature in accordance to the standards and any related updates in the ongoing development process. If you'd like to continue this discussion or have further inquiries about the implementation, please tag @better-auth-agent for additional assistance! What are your thoughts on the implementation challenges with this feature? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 07:15:11 -05:00
Author
Owner
Copy Link

@DibyodyutiMondal commented on GitHub (Feb 5, 2026):

@better-auth-agent

from what I gathered, supporting prompt=none, and supporting silent signin are 2 different things

usually in OIDC, in case of /authorize endpoint, in case of user not present or consent not present, it will redirect to the signup/sign/consent page as required. errors will redirect to the redirect_uri as per the query parameter.

However, with prompt=none, in case the user is not present or consent is required or something else happened which requires user interaction, then it is to be treated the same as error, and it will redirect to the redirect_uri, as per query parameter. the errors will be login_required, etc (as per the RFC) according to the specific context of the request.

This does not enable silent signin automatically by default, but it allows us to build silent signin feature by giving us a request we can make to detect and sign in the user if possible.

there is a separate RFC spec for silent session management in OIDC that uses a check_session_iframe, a session state cookie and a session_state query parameter in the authorization endpoint redirect response, which builds on top of the prompt none feature.

can you compile all of that and tell us what would be required to be done to implement.
maybe we should break the implementation into 2 parts - properly supporting prompt none, and silent session management on top of that

<!-- gh-comment-id:3851308708 --> @DibyodyutiMondal commented on GitHub (Feb 5, 2026): @better-auth-agent from what I gathered, supporting prompt=none, and supporting silent signin are 2 different things usually in OIDC, in case of /authorize endpoint, in case of user not present or consent not present, it will redirect to the signup/sign/consent page as required. errors will redirect to the redirect_uri as per the query parameter. However, with prompt=none, in case the user is not present or consent is required or something else happened which requires user interaction, then it is to be treated the same as error, and it will redirect to the redirect_uri, as per query parameter. the errors will be login_required, etc (as per the RFC) according to the specific context of the request. This does not enable silent signin automatically by default, but it allows us to build silent signin feature by giving us a request we can make to detect and sign in the user if possible. there is a separate RFC spec for silent session management in OIDC that uses a check_session_iframe, a session state cookie and a session_state query parameter in the authorization endpoint redirect response, which builds on top of the prompt none feature. can you compile all of that and tell us what would be required to be done to implement. maybe we should break the implementation into 2 parts - properly supporting prompt none, and silent session management on top of that
GiteaMirror commented 2026-04-13 07:15:12 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Feb 5, 2026):

To implement support for prompt=none in the OAuth provider, here are the required steps:

  1. Internal Support: Ensure that the better-auth OAuth provider can handle requests with prompt=none correctly. This includes treating the absence of user interaction as an error state and redirecting to the specified redirect_uri if user presence or consent is required [2].

  2. Update Metadata: Advertise the prompt=none option in the OpenID Connect discovery document under prompt_values_supported. This ensures clients can discover its support through the metadata [2].

  3. Error Handling: Define error semantics for unsupported scenarios. When prompt=none is called, and the conditions for silent sign-in are not met (e.g., user not present), it should return an error indicating the need for user interaction [1].

  4. Silent Session Management: Consider implementing a more comprehensive feature for silent session management on top of prompt=none, as it is intended to facilitate silent sign-in requests [2]. This could involve integrating mechanisms like check_session_iframe and handling a session state cookie [2].

It might be beneficial to break down these tasks into two parts:

  • Get prompt=none fully functional.
  • Implement the silent session management features thereafter.

Would you like further clarification on any specific aspect of this implementation process?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3851309506 --> @better-auth-agent[bot] commented on GitHub (Feb 5, 2026): To implement support for `prompt=none` in the OAuth provider, here are the required steps: 1. **Internal Support**: Ensure that the better-auth OAuth provider can handle requests with `prompt=none` correctly. This includes treating the absence of user interaction as an error state and redirecting to the specified `redirect_uri` if user presence or consent is required [[2]](https://github.com/better-auth/better-auth/issues/7700). 2. **Update Metadata**: Advertise the `prompt=none` option in the OpenID Connect discovery document under `prompt_values_supported`. This ensures clients can discover its support through the metadata [[2]](https://github.com/better-auth/better-auth/issues/7700). 3. **Error Handling**: Define error semantics for unsupported scenarios. When `prompt=none` is called, and the conditions for silent sign-in are not met (e.g., user not present), it should return an error indicating the need for user interaction [[1]](https://github.com/better-auth/better-auth/issues/6737). 4. **Silent Session Management**: Consider implementing a more comprehensive feature for silent session management on top of `prompt=none`, as it is intended to facilitate silent sign-in requests [[2]](https://github.com/better-auth/better-auth/issues/7700). This could involve integrating mechanisms like `check_session_iframe` and handling a session state cookie [[2]](https://github.com/better-auth/better-auth/issues/7700). It might be beneficial to break down these tasks into two parts: - Get `prompt=none` fully functional. - Implement the silent session management features thereafter. Would you like further clarification on any specific aspect of this implementation process? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 07:15:12 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Feb 5, 2026):

It seems you want to gather insights on implementing support for prompt=none in the Better Auth oauth-provider. Here's a summarized breakdown of how to approach this:

  1. Understanding prompt=none: This parameter is a part of OpenID Connect that allows clients to request a silent authentication attempt. If the user is not authenticated, the request should return an error, redirecting to the specified redirect_uri, rather than prompting the user for authentication.

  2. Implementing Support:

    • Internal Handling: Based on the discussions, it seems that support for prompt=none was previously not fully functional but was addressed in a recent commit that ensures it adheres to the OIDC standards, allowing silent authentication flows to work properly without causing validation errors [5].
    • Metadata Update: Ensure the prompt_values_supported metadata field reflects supported values, including none, for clients to discover the feature. Currently, it appears this is still a feature request and should be updated accordingly [6].

  3. Future Steps for Silent Sign-in:

    • Consider implementing a separate flow based on the check_session_iframe and related attributes discussed in RFCs for successful silent session management. This could be structured in two parts: fixing prompt=none support, and then layering in silent sign-in features as an enhancement.

By breaking the work into these phases, you can ensure both immediate compliance with OIDC standards and the potential for enhanced functionality in the future.

If you have more specific ideas or further questions about this implementation, feel free to ask! What parts of this implementation interest you the most?

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3851318640 --> @better-auth-agent[bot] commented on GitHub (Feb 5, 2026): It seems you want to gather insights on implementing support for `prompt=none` in the Better Auth oauth-provider. Here's a summarized breakdown of how to approach this: 1. **Understanding `prompt=none`**: This parameter is a part of OpenID Connect that allows clients to request a silent authentication attempt. If the user is not authenticated, the request should return an error, redirecting to the specified `redirect_uri`, rather than prompting the user for authentication. 2. **Implementing Support**: - **Internal Handling**: Based on the discussions, it seems that support for `prompt=none` was previously not fully functional but was addressed in a recent commit that ensures it adheres to the OIDC standards, allowing silent authentication flows to work properly without causing validation errors [[5]](https://github.com/better-auth/better-auth/pull/7665). - **Metadata Update**: Ensure the `prompt_values_supported` metadata field reflects supported values, including `none`, for clients to discover the feature. Currently, it appears this is still a feature request and should be updated accordingly [[6]](https://github.com/better-auth/better-auth/issues/7700). 3. **Future Steps for Silent Sign-in**: - Consider implementing a separate flow based on the `check_session_iframe` and related attributes discussed in RFCs for successful silent session management. This could be structured in two parts: fixing `prompt=none` support, and then layering in silent sign-in features as an enhancement. By breaking the work into these phases, you can ensure both immediate compliance with OIDC standards and the potential for enhanced functionality in the future. If you have more specific ideas or further questions about this implementation, feel free to ask! What parts of this implementation interest you the most? <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 07:15:13 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Feb 5, 2026):

To implement support for prompt="none" in Better Auth for the oauth-provider plugin, here's what needs to be considered:

  1. Understanding prompt="none": This is used in OIDC to attempt a silent authentication without user interaction. If user interaction is required (like consent or the user not being present), the request should return an error state, effectively treating it as if it failed.

  2. Implementation Steps:

    • Add support for processing the prompt="none" parameter when the authorization request is made.
    • Modify the handling of authorization responses to check for scenarios where user interaction is needed and redirect to redirect_uri with proper error handling (e.g., login_required).
    • Ensure that metadata reflects that prompt="none" is supported in the prompt_values_supported field.

  3. Silent Sign-in Management: This feature can be built once prompt="none" support is established. You might consider working on:

    • Introducing a check_session_iframe functionality that checks if the user is still logged in without needing to require their interaction explicitly.
    • Use session state cookies and pass them as needed through the session_state query parameter.

  4. Next Steps for Implementation:

    • Break the implementation process into two phases:
      • Phase 1: Implement base support for prompt="none".
      • Phase 2: Develop and integrate the silent session management using appropriate RFC specifications.

By organizing the work this way, it becomes manageable to tackle each piece systematically without overwhelming the development process.

If you have further questions about this implementation or need clarification on specific parts, feel free to ask!

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3851324794 --> @better-auth-agent[bot] commented on GitHub (Feb 5, 2026): To implement support for `prompt="none"` in Better Auth for the oauth-provider plugin, here's what needs to be considered: 1. **Understanding `prompt="none"`**: This is used in OIDC to attempt a silent authentication without user interaction. If user interaction is required (like consent or the user not being present), the request should return an error state, effectively treating it as if it failed. 2. **Implementation Steps**: - Add support for processing the `prompt="none"` parameter when the authorization request is made. - Modify the handling of authorization responses to check for scenarios where user interaction is needed and redirect to `redirect_uri` with proper error handling (e.g., `login_required`). - Ensure that metadata reflects that `prompt="none"` is supported in the `prompt_values_supported` field. 3. **Silent Sign-in Management**: This feature can be built once `prompt="none"` support is established. You might consider working on: - Introducing a `check_session_iframe` functionality that checks if the user is still logged in without needing to require their interaction explicitly. - Use session state cookies and pass them as needed through the `session_state` query parameter. 4. **Next Steps for Implementation**: - Break the implementation process into two phases: - Phase 1: Implement base support for `prompt="none"`. - Phase 2: Develop and integrate the silent session management using appropriate RFC specifications. By organizing the work this way, it becomes manageable to tackle each piece systematically without overwhelming the development process. If you have further questions about this implementation or need clarification on specific parts, feel free to ask! <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 07:15:14 -05:00
Author
Owner
Copy Link

@dvanmali commented on GitHub (Mar 11, 2026):

@himself65 this is incomplete. Wrong plugin

<!-- gh-comment-id:4035862756 --> @dvanmali commented on GitHub (Mar 11, 2026): @himself65 this is incomplete. Wrong plugin
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10879
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?