github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #3853] Mention function & wildcard match for trustedOrigins in docs #18375

New Issue
Closed
opened 2026-04-15 16:50:03 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 16:50:03 -05:00
Owner
Copy Link

Originally created by @typed-sigterm on GitHub (Aug 7, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/3853

Requires searching in the source code to find:
76205b773f/packages/better-auth/src/api/middlewares/origin-check.ts (L26)
76205b773f/packages/better-auth/src/api/middlewares/origin-check.ts (L30)

Originally created by @typed-sigterm on GitHub (Aug 7, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/3853 Requires searching in the source code to find: https://github.com/better-auth/better-auth/blob/76205b773f694c79667f8345f72f37cbc8f4007d/packages/better-auth/src/api/middlewares/origin-check.ts#L26 https://github.com/better-auth/better-auth/blob/76205b773f694c79667f8345f72f37cbc8f4007d/packages/better-auth/src/api/middlewares/origin-check.ts#L30
GiteaMirror added the locked label 2026-04-15 16:50:03 -05:00
GiteaMirror commented 2026-04-15 16:50:04 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 7, 2025):

Function and wildcard matching are both supported for trustedOrigins. You can provide either an array of strings or a function that returns (or resolves to) an array of strings. This allows you to generate trusted origins dynamically based on the request context. Wildcard patterns like *.example.com or https://*.example.com are supported and matched using glob-like rules—protocol-specific wildcards require an exact protocol match, while protocol-agnostic wildcards match any protocol but require the domain to match. You can also use "*" to allow any domain, but this is a security risk and should be used with caution see code reference types docs example.

Example usage:

// Static list with wildcards
trustedOrigins: [
  "https://*.example.com",
  "http://localhost:3000",
  "myapp://*"
]

// Dynamic function
trustedOrigins: async (request) => {
  // e.g., fetch allowed origins from a database
  return ["https://*.example.com", "https://special.example.org"];
}

Currently, the official docs mention wildcard support but do not yet document function support. Both are implemented and available for use.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3164506721 --> @dosubot[bot] commented on GitHub (Aug 7, 2025): <!-- Answer --> Function and wildcard matching are both supported for `trustedOrigins`. You can provide either an array of strings or a function that returns (or resolves to) an array of strings. This allows you to generate trusted origins dynamically based on the request context. Wildcard patterns like `*.example.com` or `https://*.example.com` are supported and matched using glob-like rules—protocol-specific wildcards require an exact protocol match, while protocol-agnostic wildcards match any protocol but require the domain to match. You can also use `"*"` to allow any domain, but this is a security risk and should be used with caution [see code reference](https://github.com/better-auth/better-auth/blob/723a4f4dde3365001bc0c6e4c554950a2e83374b/packages/better-auth/src/api/middlewares/origin-check.ts) [types](https://github.com/better-auth/better-auth/blob/723a4f4dde3365001bc0c6e4c554950a2e83374b/packages/better-auth/src/types/options.ts) [docs example](https://better-auth.com/docs/integrations/expo). **Example usage:** ```ts // Static list with wildcards trustedOrigins: [ "https://*.example.com", "http://localhost:3000", "myapp://*" ] // Dynamic function trustedOrigins: async (request) => { // e.g., fetch allowed origins from a database return ["https://*.example.com", "https://special.example.org"]; } ``` Currently, the official docs mention wildcard support but do not yet document function support. Both are implemented and available for use. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a043b64e-de62-44f3-a72f-c57bf5e89e42?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/3853)
GiteaMirror commented 2026-04-15 16:50:05 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Aug 7, 2025):

closing via #3857

<!-- gh-comment-id:3164883265 --> @Kinfe123 commented on GitHub (Aug 7, 2025): closing via #3857
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#18375
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?