github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7815] [MERGED] fix(sso): harden SAML ACS error redirects and add regression test for #7777 #15817

New Issue
Closed
opened 2026-04-13 10:14:33 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:14:33 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7815
Author: @Paola3stefania
Created: 2/5/2026
Status: ✅ Merged
Merged: 2/10/2026
Merged by: @himself65

Base: canary ← Head: refactor/sso-saml-acs-hardening

📝 Commits (3)

  • a888dd7 fix errors and buffer in sso
  • 8583d25 Merge branch 'canary' into refactor/sso-saml-acs-hardening
  • 39b4363 Merge branch 'canary' into refactor/sso-saml-acs-hardening

📊 Changes

2 files changed (+220 additions, -78 deletions)

View changed files

📝 packages/sso/src/routes/sso.ts (+66 -78)
📝 packages/sso/src/saml.test.ts (+154 -0)

📄 Description

hardening code to finalize https://github.com/better-auth/better-auth/issues/7777

Summary by cubic

Hardened SAML ACS and callback redirects to always use trusted, safe URLs, preventing open redirects and misrouted error paths. Added regression tests for RelayState handling (fixes #7777) and switched base64 decoding to a cross‑platform utility.

  • Bug Fixes

    • Guard all ACS/callback error redirects with getSafeRedirectUrl and trusted origin checks; prefer RelayState.errorURL, then callbackURL, then provider config.
    • Resolve verification‑ID RelayState to the correct callbackURL on ACS (SP‑initiated) and fallback to provider callbackUrl when RelayState is invalid.
    • Compute and reuse safeErrorUrl and safeCallbackUrl for consistent, safe redirects.

  • Refactors

    • Replace Node Buffer decoding with @better-auth/utils/base64 + TextDecoder and improve decoded SAML response logging.
    • Centralize isTrusted origin checks passed into getSafeRedirectUrl.

Written for commit 39b43635ed. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7815 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 2/5/2026 **Status:** ✅ Merged **Merged:** 2/10/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `refactor/sso-saml-acs-hardening` --- ### 📝 Commits (3) - [`a888dd7`](https://github.com/better-auth/better-auth/commit/a888dd75505f50fe555484582547bfce59276763) fix errors and buffer in sso - [`8583d25`](https://github.com/better-auth/better-auth/commit/8583d25655cbb50aa01a9ceb337e914c038c31cb) Merge branch 'canary' into refactor/sso-saml-acs-hardening - [`39b4363`](https://github.com/better-auth/better-auth/commit/39b43635ed0c7c92595eaaa361cc69d349b34120) Merge branch 'canary' into refactor/sso-saml-acs-hardening ### 📊 Changes **2 files changed** (+220 additions, -78 deletions) <details> <summary>View changed files</summary> 📝 `packages/sso/src/routes/sso.ts` (+66 -78) 📝 `packages/sso/src/saml.test.ts` (+154 -0) </details> ### 📄 Description hardening code to finalize https://github.com/better-auth/better-auth/issues/7777 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Hardened SAML ACS and callback redirects to always use trusted, safe URLs, preventing open redirects and misrouted error paths. Added regression tests for RelayState handling (fixes #7777) and switched base64 decoding to a cross‑platform utility. - **Bug Fixes** - Guard all ACS/callback error redirects with getSafeRedirectUrl and trusted origin checks; prefer RelayState.errorURL, then callbackURL, then provider config. - Resolve verification‑ID RelayState to the correct callbackURL on ACS (SP‑initiated) and fallback to provider callbackUrl when RelayState is invalid. - Compute and reuse safeErrorUrl and safeCallbackUrl for consistent, safe redirects. - **Refactors** - Replace Node Buffer decoding with @better-auth/utils/base64 + TextDecoder and improve decoded SAML response logging. - Centralize isTrusted origin checks passed into getSafeRedirectUrl. <sup>Written for commit 39b43635ed0c7c92595eaaa361cc69d349b34120. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:14:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15817
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?