github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-24 08:58:45 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Wildcard issues with trustedOrigins #2102

New Issue
Closed
opened 2026-03-13 09:27:25 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-03-13 09:27:25 -05:00
Owner
Copy Link
Copy Source

Originally created by @Fyrlex on GitHub (Oct 11, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Try using wildcards with schemes in the trustedOrigins and make requests from devices with local IPs (e.g. 10.x or 172.x)

Current vs. Expected behavior

Current behavior is a Forbidden response and an error
API_URL is my staging https:// api url.

If it's a valid URL, please add exp://10.0.0.29:8081/--/ to trustedOrigins in your auth config
 Current list of trustedOrigins: exp://*/--/*,exp://*/--,exp://*/*,exp://10.0.0.*:*/*,exp://192.168.*.*:*/*,exp://172.*.*.*:*/*,exp://localhost:*/*,API_URL

I am trying to match any address for the scheme exp:// using the * but it doesn't appear to work.

What version of Better Auth are you using?

1.3.27

System info

{
  "system": {
    "platform": "win32",
    "arch": "x64",
    "version": "Windows 11 Home",
    "release": "10.0.26100",
    "cpuCount": 12,
    "cpuModel": "AMD Ryzen 5 3600X 6-Core Processor             ",
    "totalMemory": "15.92 GB",
    "freeMemory": "1.96 GB"
  },
  "node": {
    "version": "v22.12.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "10.9.0"
  },
  "frameworks": [
    {
      "name": "react",
      "version": "^19.1.1"
    },
    {
      "name": "fastify",
      "version": "^5.5.0"
    }
  ],
  "databases": [
    {
      "name": "pg",
      "version": "^8.16.3"
    },
    {
      "name": "drizzle",
      "version": "^0.44.6"
    }
  ],
  "betterAuth": {
    "version": "^1.3.27",
    "config": null

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({
  // ...
  trustedOrigins: [
    API_ORIGIN,
    'exp://*/--/*',
    'exp://*/--',
    'exp://*/*',
    // Add specific IP range patterns for common local development
    'exp://10.0.0.*:*/*', // covers 10.0.0.x with any port
    'exp://192.168.*.*:*/*', // covers 192.168.x.x with any port
    'exp://172.*.*.*:*/*', // covers 172.x.x.x with any port
    'exp://localhost:*/*', // localhost
  ],
  // ...
});

Additional context

No response

Originally created by @Fyrlex on GitHub (Oct 11, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Try using wildcards with schemes in the trustedOrigins and make requests from devices with local IPs (e.g. 10.x or 172.x) ### Current vs. Expected behavior Current behavior is a Forbidden response and an error API_URL is my staging https:// api url. ``` If it's a valid URL, please add exp://10.0.0.29:8081/--/ to trustedOrigins in your auth config Current list of trustedOrigins: exp://*/--/*,exp://*/--,exp://*/*,exp://10.0.0.*:*/*,exp://192.168.*.*:*/*,exp://172.*.*.*:*/*,exp://localhost:*/*,API_URL ``` I am trying to match any address for the scheme exp:// using the * but it doesn't appear to work. ### What version of Better Auth are you using? 1.3.27 ### System info ```bash { "system": { "platform": "win32", "arch": "x64", "version": "Windows 11 Home", "release": "10.0.26100", "cpuCount": 12, "cpuModel": "AMD Ryzen 5 3600X 6-Core Processor ", "totalMemory": "15.92 GB", "freeMemory": "1.96 GB" }, "node": { "version": "v22.12.0", "env": "development" }, "packageManager": { "name": "npm", "version": "10.9.0" }, "frameworks": [ { "name": "react", "version": "^19.1.1" }, { "name": "fastify", "version": "^5.5.0" } ], "databases": [ { "name": "pg", "version": "^8.16.3" }, { "name": "drizzle", "version": "^0.44.6" } ], "betterAuth": { "version": "^1.3.27", "config": null ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ // ... trustedOrigins: [ API_ORIGIN, 'exp://*/--/*', 'exp://*/--', 'exp://*/*', // Add specific IP range patterns for common local development 'exp://10.0.0.*:*/*', // covers 10.0.0.x with any port 'exp://192.168.*.*:*/*', // covers 192.168.x.x with any port 'exp://172.*.*.*:*/*', // covers 172.x.x.x with any port 'exp://localhost:*/*', // localhost ], // ... }); ``` ### Additional context _No response_
GiteaMirror commented 2026-03-13 09:27:27 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 11, 2025):

Hi @Fyrlex! I'm Dosu and I’m helping the better-auth team.

Wildcard matching in trustedOrigins does support patterns like exp://* and IP ranges, but the matching logic has limitations with complex wildcards and custom schemes. Patterns such as exp://*/--/* or exp://*/* may not reliably match all local IP addresses due to how the parser interprets wildcards in the scheme and host portions. For local IPs, you need to use explicit patterns like exp://10.0.0.*:*/*, exp://192.168.*.*:*/*, and exp://172.*.*.*:*/*—these are more likely to work as intended for development devices, but broad wildcards for the scheme or host may not match as expected reference.

If you want to allow any origin for development, you can use "*" as a trusted origin, but this is a security risk and should only be used in safe environments reference. There are no documented workarounds for more flexible scheme wildcards; the safest approach is to explicitly list the IP ranges and hostnames you need reference.

Let me know if you need help crafting a specific pattern for your use case!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 11, 2025): <!-- Greeting --> Hi @Fyrlex! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> Wildcard matching in `trustedOrigins` does support patterns like `exp://*` and IP ranges, but the matching logic has limitations with complex wildcards and custom schemes. Patterns such as `exp://*/--/*` or `exp://*/*` may not reliably match all local IP addresses due to how the parser interprets wildcards in the scheme and host portions. For local IPs, you need to use explicit patterns like `exp://10.0.0.*:*/*`, `exp://192.168.*.*:*/*`, and `exp://172.*.*.*:*/*`—these are more likely to work as intended for development devices, but broad wildcards for the scheme or host may not match as expected [reference](https://github.com/better-auth/better-auth/issues/3853). If you want to allow any origin for development, you can use `"*"` as a trusted origin, but this is a security risk and should only be used in safe environments [reference](https://github.com/better-auth/better-auth/issues/764#issuecomment-2518162657). There are no documented workarounds for more flexible scheme wildcards; the safest approach is to explicitly list the IP ranges and hostnames you need [reference](https://github.com/better-auth/better-auth/issues/3853). Let me know if you need help crafting a specific pattern for your use case! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5231)
GiteaMirror commented 2026-03-13 09:27:27 -05:00
Author
Owner
Copy Link
Copy Source

@Fyrlex commented on GitHub (Oct 11, 2025):

Hi @Fyrlex! I'm Dosu and I’m helping the better-auth team.

Wildcard matching in trustedOrigins does support patterns like exp://* and IP ranges, but the matching logic has limitations with complex wildcards and custom schemes. Patterns such as exp://*/--/* or exp://*/* may not reliably match all local IP addresses due to how the parser interprets wildcards in the scheme and host portions. For local IPs, you need to use explicit patterns like exp://10.0.0.*:*/*, exp://192.168.*.*:*/*, and exp://172.*.*.*:*/*—these are more likely to work as intended for development devices, but broad wildcards for the scheme or host may not match as expected reference.

If you want to allow any origin for development, you can use "*" as a trusted origin, but this is a security risk and should only be used in safe environments reference. There are no documented workarounds for more flexible scheme wildcards; the safest approach is to explicitly list the IP ranges and hostnames you need reference.

Let me know if you need help crafting a specific pattern for your use case!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

I used exp://10.0.0.*:*/* and the error stated this was set as a trusted origin and the request address should have matched but it was blocked.

@Fyrlex commented on GitHub (Oct 11, 2025): > Hi [@Fyrlex](https://github.com/Fyrlex)! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. > > Wildcard matching in `trustedOrigins` does support patterns like `exp://*` and IP ranges, but the matching logic has limitations with complex wildcards and custom schemes. Patterns such as `exp://*/--/*` or `exp://*/*` may not reliably match all local IP addresses due to how the parser interprets wildcards in the scheme and host portions. For local IPs, you need to use explicit patterns like `exp://10.0.0.*:*/*`, `exp://192.168.*.*:*/*`, and `exp://172.*.*.*:*/*`—these are more likely to work as intended for development devices, but broad wildcards for the scheme or host may not match as expected [reference](https://github.com/better-auth/better-auth/issues/3853). > > If you want to allow any origin for development, you can use `"*"` as a trusted origin, but this is a security risk and should only be used in safe environments [reference](https://github.com/better-auth/better-auth/issues/764#issuecomment-2518162657). There are no documented workarounds for more flexible scheme wildcards; the safest approach is to explicitly list the IP ranges and hostnames you need [reference](https://github.com/better-auth/better-auth/issues/3853). > > Let me know if you need help crafting a specific pattern for your use case! > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a7c8dbe4-038c-4998-9066-115ff62f58f8?feedback_type=other)  [![Chat with Dosu](https://camo.githubusercontent.com/d9ffebb979729c9ef0fc4e3090dbae5b17cabbfec8afe378ada6b81913d6ad8a/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://camo.githubusercontent.com/d562c2df5e4567ea41d37f1d91a4da0839d8341037045b103b2da268998de17f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/4649f705e2396d6f328dbc8e800a0509c9c17b3b20253b36706c393df124b93d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5231) I used `exp://10.0.0.*:*/*` and the error stated this was set as a trusted origin and the request address should have matched but it was blocked.
GiteaMirror commented 2026-03-13 09:27:28 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 11, 2025):

The matching logic for trustedOrigins in Better Auth uses glob-like wildcards, but patterns for custom schemes and IP ranges (like exp://10.0.0.*:*/*) may not reliably match all requests due to how the middleware parses and compares the origin string. Even if the pattern is present, requests can still fail if the origin string from the client doesn't align exactly with how the pattern is interpreted by the matcher—especially for non-standard schemes like exp:// and complex wildcards. This is a known limitation in the current implementation, and there are no documented workarounds that guarantee reliable matching for these cases see code reference.

If you need to unblock development, using "*" as a trusted origin will allow all requests, but this should only be done in safe environments due to security risks reference. For more granular control, you may need to explicitly list every possible origin or IP address your devices use, as broad wildcards for custom schemes are not reliably supported.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 11, 2025): <!-- Answer --> The matching logic for trustedOrigins in Better Auth uses glob-like wildcards, but patterns for custom schemes and IP ranges (like `exp://10.0.0.*:*/*`) may not reliably match all requests due to how the middleware parses and compares the origin string. Even if the pattern is present, requests can still fail if the origin string from the client doesn't align exactly with how the pattern is interpreted by the matcher—especially for non-standard schemes like `exp://` and complex wildcards. This is a known limitation in the current implementation, and there are no documented workarounds that guarantee reliable matching for these cases [see code reference](https://github.com/better-auth/better-auth/blob/95bcee281e4b2931c281501ee5fdd2b4137900a1/packages/better-auth/src/api/middlewares/origin-check.ts). If you need to unblock development, using `"*"` as a trusted origin will allow all requests, but this should only be done in safe environments due to security risks [reference](https://github.com/better-auth/better-auth/issues/764#issuecomment-2518162657). For more granular control, you may need to explicitly list every possible origin or IP address your devices use, as broad wildcards for custom schemes are not reliably supported. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6ac767cf-7fa1-4584-a6cb-2acf863f120d?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5231)
GiteaMirror commented 2026-03-13 09:27:29 -05:00
Author
Owner
Copy Link
Copy Source

@AntonVishal commented on GitHub (Oct 12, 2025):

I can work on this issue guys

@AntonVishal commented on GitHub (Oct 12, 2025): I can work on this issue guys
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2102