github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7855] fix(oauth-provider): resource indicators rfc 8707 #15840

New Issue
Open
opened 2026-04-13 10:15:29 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:15:29 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7855
Author: @dvanmali
Created: 2/8/2026
Status: 🔄 Open

Base: main ← Head: opResourceIndicators

📝 Commits (6)

  • bb5d173 fix: follow resource indicators rfc8707
  • 2da8343 fix: check resource after pkce
  • 235432d fix: ai suggestions
  • 258fb63 fix: gustavovalverde code review suggestions
  • 6f36cba fix: resource subset degrade
  • c87fe73 fix: cubic ai suggestions

📊 Changes

9 files changed (+190 additions, -19 deletions)

View changed files

📝 docs/content/docs/plugins/oauth-provider.mdx (+7 -2)
📝 packages/oauth-provider/src/authorize.ts (+42 -0)
📝 packages/oauth-provider/src/consent.ts (+3 -0)
📝 packages/oauth-provider/src/introspect.ts (+2 -1)
📝 packages/oauth-provider/src/oauth.ts (+15 -7)
📝 packages/oauth-provider/src/schema.ts (+12 -0)
📝 packages/oauth-provider/src/token.ts (+82 -7)
📝 packages/oauth-provider/src/types/index.ts (+18 -2)
📝 packages/oauth-provider/src/types/zod.ts (+9 -0)

📄 Description

Follows the resource indicator spec RFC 8707.

Improvements:

  • Prevents resource value changes between /authorize and /token
  • Restricts refresh and access tokens to resources specified at issuance
  • customAccessTokenClaims properly uses the resources field to indicate the resource at both /token and /introspect. (deprecates resource field).
  • resource supported across all grant types: authorization_code, client_credentials, refresh_token

Closes: #8298

Summary by cubic

Implements RFC 8707 resource indicators across the OAuth provider. Tokens are bound to requested resources with strict checks at authorize, token, and refresh; invalid resources return invalid_target.

  • New Features

    • Accepts resource on /authorize and /token as a string, array, or repeated parameter; validated as safe URLs with no fragments. Consent stores resources and re-prompts if new ones are requested (with prompt=none, returns consent_required).
    • /token requires resource if it was sent to /authorize, and enforces that requested resources are a subset of those authorized. Refresh requests may only include resources present on the refresh token; refresh tokens retain their original resources.
    • Access and refresh tokens persist resources; customAccessTokenClaims now receives resources. Using resource yields a JWT access token (opaque tokens also store resources). Supported on authorization_code, client_credentials, and refresh_token.

  • Migration

    • Replace customAccessTokenClaims.resource with customAccessTokenClaims.resources.
    • Remove resource from /introspect requests; use resources via customAccessTokenClaims for audience-based claims.

Written for commit c87fe7309dd433c606a66f49f906917d6b20b064. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7855 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 2/8/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `opResourceIndicators` --- ### 📝 Commits (6) - [`bb5d173`](https://github.com/better-auth/better-auth/commit/bb5d1731aaf5b65a03bc3b5d4d97254df6fec344) fix: follow resource indicators rfc8707 - [`2da8343`](https://github.com/better-auth/better-auth/commit/2da83437f798c3c111192936d202d142d0a07a44) fix: check resource after pkce - [`235432d`](https://github.com/better-auth/better-auth/commit/235432d3aa70cbf395ace4b41f5051ac661dcac2) fix: ai suggestions - [`258fb63`](https://github.com/better-auth/better-auth/commit/258fb634a7dd41024b1f021bc97d2bd502019cc7) fix: gustavovalverde code review suggestions - [`6f36cba`](https://github.com/better-auth/better-auth/commit/6f36cba64a5f8d66f8463b9f37e5efc16b332d6e) fix: resource subset degrade - [`c87fe73`](https://github.com/better-auth/better-auth/commit/c87fe7309dd433c606a66f49f906917d6b20b064) fix: cubic ai suggestions ### 📊 Changes **9 files changed** (+190 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/oauth-provider.mdx` (+7 -2) 📝 `packages/oauth-provider/src/authorize.ts` (+42 -0) 📝 `packages/oauth-provider/src/consent.ts` (+3 -0) 📝 `packages/oauth-provider/src/introspect.ts` (+2 -1) 📝 `packages/oauth-provider/src/oauth.ts` (+15 -7) 📝 `packages/oauth-provider/src/schema.ts` (+12 -0) 📝 `packages/oauth-provider/src/token.ts` (+82 -7) 📝 `packages/oauth-provider/src/types/index.ts` (+18 -2) 📝 `packages/oauth-provider/src/types/zod.ts` (+9 -0) </details> ### 📄 Description Follows the resource indicator spec [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html). **Improvements**: - Prevents `resource` value changes between `/authorize` and `/token` - Restricts refresh and access tokens to `resources` specified at issuance - `customAccessTokenClaims` properly uses the `resources` field to indicate the resource at both `/token` and `/introspect`. (deprecates `resource` field). - `resource` supported across all grant types: authorization_code, client_credentials, refresh_token Closes: #8298 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Implements RFC 8707 resource indicators across the OAuth provider. Tokens are bound to requested resources with strict checks at authorize, token, and refresh; invalid resources return `invalid_target`. - **New Features** - Accepts `resource` on `/authorize` and `/token` as a string, array, or repeated parameter; validated as safe URLs with no fragments. Consent stores resources and re-prompts if new ones are requested (with `prompt=none`, returns `consent_required`). - `/token` requires `resource` if it was sent to `/authorize`, and enforces that requested resources are a subset of those authorized. Refresh requests may only include resources present on the refresh token; refresh tokens retain their original resources. - Access and refresh tokens persist `resources`; `customAccessTokenClaims` now receives `resources`. Using `resource` yields a JWT access token (opaque tokens also store resources). Supported on `authorization_code`, `client_credentials`, and `refresh_token`. - **Migration** - Replace `customAccessTokenClaims.resource` with `customAccessTokenClaims.resources`. - Remove `resource` from `/introspect` requests; use `resources` via `customAccessTokenClaims` for audience-based claims. <sup>Written for commit c87fe7309dd433c606a66f49f906917d6b20b064. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:15:29 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15840
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?