github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6675] [MERGED] fix(saml): IdP-Initiated Callback Routing #15062

New Issue
Closed
opened 2026-04-13 09:48:23 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:48:23 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6675
Author: @Paola3stefania
Created: 12/10/2025
Status: ✅ Merged
Merged: 1/14/2026
Merged by: @himself65

Base: canary ← Head: fix/saml-idp-callback-routing

📝 Commits (10+)

  • a4acc36 chore: add relay persistance support
  • c11b6f9 chore(sso): respect requestSignup flag
  • 4f94a8e feat: add GET method support to SAML callback route
  • 08507ae feat: implement GET handler
  • a3bf798 feat: add docs and tests
  • 3718708 fix: add proper types to tests
  • b8c3115 add : tests
  • cd260da feat: improve security
  • c44f073 rm cmts
  • 4a77b25 fix: update docu

📊 Changes

17 files changed (+1745 additions, -305 deletions)

View changed files

📝 docs/content/docs/guides/saml-sso-with-okta.mdx (+6 -1)
📝 docs/content/docs/plugins/sso.mdx (+40 -1)
📝 packages/better-auth/src/api/index.ts (+2 -8)
📝 packages/better-auth/src/api/middlewares/origin-check.ts (+19 -1)
📝 packages/better-auth/src/api/rate-limiter/index.ts (+3 -3)
📝 packages/better-auth/src/context/create-context.ts (+3 -1)
📝 packages/better-auth/src/context/helpers.ts (+1 -1)
📝 packages/better-auth/src/oauth2/state.ts (+22 -170)
📝 packages/better-auth/src/social.test.ts (+0 -1)
➕ packages/better-auth/src/state.ts (+221 -0)
📝 packages/better-auth/src/utils/index.ts (+2 -0)
📝 packages/core/src/types/context.ts (+8 -7)
➕ packages/core/src/utils/url.ts (+43 -0)
📝 packages/sso/src/index.ts (+22 -0)
📝 packages/sso/src/routes/sso.ts (+139 -14)
➕ packages/sso/src/saml-state.ts (+78 -0)
📝 packages/sso/src/saml.test.ts (+1136 -97)

📄 Description

Summary by cubic

Fix SAML IdP-initiated callback routing with GET support, safe redirects, and persisted RelayState. IdP- and SP-initiated flows now redirect reliably without loops and respect requestSignUp.

  • Bug Fixes

    • Allow GET and POST on /sso/saml2/callback/:providerId; handle RelayState via body or query.
    • Validate session on GET; redirect to error URL if missing.
    • Generate and validate RelayState; fall back to app origin or configured callbackUrl; prevent open redirects and callback-to-callback loops.
    • Require SAMLResponse on POST; perform safe redirect after session is set.
    • Respect requestSignUp when disableImplicitSignUp is true.
    • Skip origin checks for SAML callback and ACS endpoints to allow external IdP POSTs; other routes remain protected.

  • Refactors

    • Introduce generic state helpers shared by OAuth2 and SAML RelayState.

Written for commit c5e5100364. Summary will update on new commits.

This fixes https://github.com/better-auth/better-auth/issues/6615

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6675 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/10/2025 **Status:** ✅ Merged **Merged:** 1/14/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `fix/saml-idp-callback-routing` --- ### 📝 Commits (10+) - [`a4acc36`](https://github.com/better-auth/better-auth/commit/a4acc36c4acaa3d1df1c769eb8143a5f40af0ade) chore: add relay persistance support - [`c11b6f9`](https://github.com/better-auth/better-auth/commit/c11b6f9fdbc63cd62cb7f0ecf5c7c4dab8419a8a) chore(sso): respect requestSignup flag - [`4f94a8e`](https://github.com/better-auth/better-auth/commit/4f94a8ef7c87b315effeb5ff87c4600cd58c7938) feat: add GET method support to SAML callback route - [`08507ae`](https://github.com/better-auth/better-auth/commit/08507aee82416b9f842ab5800e8f5dfe463ed178) feat: implement GET handler - [`a3bf798`](https://github.com/better-auth/better-auth/commit/a3bf79873ba8817ee116afb5f2e6cd0212fc7afd) feat: add docs and tests - [`3718708`](https://github.com/better-auth/better-auth/commit/371870863e1a749612b13f58d9b7fecb780bb937) fix: add proper types to tests - [`b8c3115`](https://github.com/better-auth/better-auth/commit/b8c3115aee947758dcb159b3173e4e6bb32e1551) add : tests - [`cd260da`](https://github.com/better-auth/better-auth/commit/cd260da222bc120ef45ecfeab861034eae085e63) feat: improve security - [`c44f073`](https://github.com/better-auth/better-auth/commit/c44f0730d527c89463b48b98faae1032dbf97f6e) rm cmts - [`4a77b25`](https://github.com/better-auth/better-auth/commit/4a77b2502c989ba65fb7adcc8104242f23be777e) fix: update docu ### 📊 Changes **17 files changed** (+1745 additions, -305 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/guides/saml-sso-with-okta.mdx` (+6 -1) 📝 `docs/content/docs/plugins/sso.mdx` (+40 -1) 📝 `packages/better-auth/src/api/index.ts` (+2 -8) 📝 `packages/better-auth/src/api/middlewares/origin-check.ts` (+19 -1) 📝 `packages/better-auth/src/api/rate-limiter/index.ts` (+3 -3) 📝 `packages/better-auth/src/context/create-context.ts` (+3 -1) 📝 `packages/better-auth/src/context/helpers.ts` (+1 -1) 📝 `packages/better-auth/src/oauth2/state.ts` (+22 -170) 📝 `packages/better-auth/src/social.test.ts` (+0 -1) ➕ `packages/better-auth/src/state.ts` (+221 -0) 📝 `packages/better-auth/src/utils/index.ts` (+2 -0) 📝 `packages/core/src/types/context.ts` (+8 -7) ➕ `packages/core/src/utils/url.ts` (+43 -0) 📝 `packages/sso/src/index.ts` (+22 -0) 📝 `packages/sso/src/routes/sso.ts` (+139 -14) ➕ `packages/sso/src/saml-state.ts` (+78 -0) 📝 `packages/sso/src/saml.test.ts` (+1136 -97) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fix SAML IdP-initiated callback routing with GET support, safe redirects, and persisted RelayState. IdP- and SP-initiated flows now redirect reliably without loops and respect requestSignUp. - **Bug Fixes** - Allow GET and POST on /sso/saml2/callback/:providerId; handle RelayState via body or query. - Validate session on GET; redirect to error URL if missing. - Generate and validate RelayState; fall back to app origin or configured callbackUrl; prevent open redirects and callback-to-callback loops. - Require SAMLResponse on POST; perform safe redirect after session is set. - Respect requestSignUp when disableImplicitSignUp is true. - Skip origin checks for SAML callback and ACS endpoints to allow external IdP POSTs; other routes remain protected. - **Refactors** - Introduce generic state helpers shared by OAuth2 and SAML RelayState. <sup>Written for commit c5e51003649d7c46d4b8b4bdea9b5b93e73b3f17. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> This fixes https://github.com/better-auth/better-auth/issues/6615 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:48:23 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15062
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?