github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8361] SSO domain verification fails when domain is domain and not URL #11067

New Issue
Closed
opened 2026-04-13 07:26:46 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-13 07:26:46 -05:00
Owner
Copy Link

Originally created by @smndtrl on GitHub (Mar 4, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8361

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. registerSSOProvider with domain: <any domain>
  2. requestDomainVerification fails with ERR_INVALID_URL

Current vs. Expected behavior

domain should execute normally with a valid domain

What version of Better Auth are you using?

main

System info

...

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

The raw domain e.g. github.com is put into new URL which throws because a domain is not a URL.

bd980f8c5b/packages/sso/src/routes/domain-verification.ts (L245)

The tests have a URL in the domain field and therefore don't catch it.

bd980f8c5b/packages/sso/src/domain-verification.test.ts (L130)

Originally created by @smndtrl on GitHub (Mar 4, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8361 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. `registerSSOProvider` with `domain: <any domain>` 2. `requestDomainVerification` fails with `ERR_INVALID_URL` ### Current vs. Expected behavior `domain` should execute normally with a valid domain ### What version of Better Auth are you using? main ### System info ```bash ... ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context The raw domain e.g. `github.com` is put into `new URL` which throws because a domain is not a URL. https://github.com/better-auth/better-auth/blob/bd980f8c5b2ad9ff13a78d27ecbe27fd92ed879f/packages/sso/src/routes/domain-verification.ts#L245 The tests have a URL in the domain field and therefore don't catch it. https://github.com/better-auth/better-auth/blob/bd980f8c5b2ad9ff13a78d27ecbe27fd92ed879f/packages/sso/src/domain-verification.test.ts#L130
GiteaMirror added the lockedbug labels 2026-04-13 07:26:46 -05:00
GiteaMirror commented 2026-04-13 07:26:48 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 4, 2026):

Hi @smndtrl! I'm Dosu and I’m helping the better-auth team.

You've correctly identified the bug. The issue is at line 263 of domain-verification.ts where new URL(provider.domain).hostname is called - JavaScript's URL constructor requires a protocol scheme.

The domain schema accepts any string without enforcing URL format, creating a mismatch between what's allowed at registration vs. what the verification code expects.

Workaround: Use full URLs with protocols when registering:

  • ✅ "https://github.com"
  • ❌ "github.com"

This specific issue doesn't appear to be tracked yet. A fix could either enforce URL format in the schema validation, or normalize plain domains by prepending https:// before parsing.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3995772641 --> @dosubot[bot] commented on GitHub (Mar 4, 2026): <!-- Greeting --> Hi @smndtrl! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> You've correctly identified the bug. The issue is at [line 263 of domain-verification.ts](https://github.com/better-auth/better-auth/blob/54c84939ff6498d90a7c1147b4ade0061ed6c08d/packages/sso/src/routes/domain-verification.ts#L263) where `new URL(provider.domain).hostname` is called - JavaScript's `URL` constructor requires a protocol scheme. The [domain schema](https://github.com/better-auth/better-auth/blob/54c84939ff6498d90a7c1147b4ade0061ed6c08d/packages/sso/src/routes/sso.ts#L303-L306) accepts any string without enforcing URL format, creating a mismatch between what's allowed at registration vs. what the verification code expects. **Workaround**: Use full URLs with protocols when registering: - ✅ `"https://github.com"` - ❌ `"github.com"` This specific issue doesn't appear to be tracked yet. A fix could either enforce URL format in the schema validation, or normalize plain domains by prepending `https://` before parsing. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/423b52f8-d75d-487f-9be0-ccdf88b2a972?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%27ve%20correctly%20identified%20the%20bug.%20The%20issue%20is%20at%20%5Bline%20263%20of%20domain-verification.ts%5D%28https%3A//github.com/better-auth/better-auth/blob/54c84939ff6498d90a7c1147b4ade0061ed6c08d/packages/sso/src/routes/domain-verification.ts%23L263%29%20where%20%60new%20URL%28provider.domain%29.hostname%60%20is%20called%20-%20JavaScript%27s%20%60URL%60%20constructor%20requires%20a%20protocol%20scheme.%0A%0AThe%20%5Bdomain%20schema%5D%28https%3A//github.com/better-auth/better-auth/blob/54c84939ff6498d90a7c1147b4ade0061ed6c08d/packages/sso/src/routes/sso.ts%23L303-L306%29%20accepts%20any%20string%20without%20enforcing%20URL%20format%2C%20creating%20a%20mismatch%20between%20what%27s%20allowed%20at%20registration%20vs.%20what%20the%20verification%20code%20expects.%0A%0A%2A%2AWorkaround%2A%2A%3A%20Use%20full%20URLs%20with%20protocols%20when%20registering%3A%0A-%20%E2%9C%85%20%60%22https%3A//github.com%22%60%0A-%20%E2%9D%8C%20%60%22github.com%22%60%0A%0AThis%20specific%20issue%20doesn%27t%20appear%20to%20be%20tracked%20yet.%20A%20fix%20could%20either%20enforce%20URL%20format%20in%20the%20schema%20validation%2C%20or%20normalize%20plain%20domains%20by%20prepending%20%60https%3A//%60%20before%20parsing.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8361)
GiteaMirror commented 2026-04-13 07:26:49 -05:00
Author
Owner
Copy Link

@GautamBytes commented on GitHub (Mar 4, 2026):

Hey @smndtrl , will look into it!

<!-- gh-comment-id:3995864490 --> @GautamBytes commented on GitHub (Mar 4, 2026): Hey @smndtrl , will look into it!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#11067
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?