github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6462] [MERGED] feat: add ctx.isTrustedDomain helper #23584

New Issue
Closed
opened 2026-04-15 21:50:41 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:50:41 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6462
Author: @jonathansamines
Created: 12/1/2025
Status: ✅ Merged
Merged: 12/4/2025
Merged by: @Bekacru

Base: canary ← Head: chore/refactor-trusted-domains

📝 Commits (10+)

  • 4309910 chore(better-auth): refactor trusted domains for easier reuse
  • a5b733b Merge branch 'canary' into chore/refactor-trusted-domains
  • 2870aec Merge branch 'canary' into chore/refactor-trusted-domains
  • 84f6cd3 chore(better-auth): add tests for trusted origins helper
  • c5f2ed6 docs(better-auth): add trusted origin docs
  • 93703d5 chore: fix typos and docs
  • 8bdac7a docs: add reference to allowRelativePaths option
  • c344f15 Merge branch 'canary' into chore/refactor-trusted-domains
  • 86cf320 chore: fix zod import
  • ec2ba61 Merge branch 'canary' into chore/refactor-trusted-domains

📊 Changes

9 files changed (+422 additions, -352 deletions)

View changed files

📝 docs/content/docs/concepts/plugins.mdx (+42 -0)
📝 docs/content/docs/reference/security.mdx (+18 -1)
📝 packages/better-auth/src/api/middlewares/origin-check.test.ts (+0 -269)
📝 packages/better-auth/src/api/middlewares/origin-check.ts (+11 -82)
➕ packages/better-auth/src/auth/trusted-origins.test.ts (+289 -0)
➕ packages/better-auth/src/auth/trusted-origins.ts (+45 -0)
📝 packages/better-auth/src/context/__snapshots__/create-context.test.ts.snap (+1 -0)
📝 packages/better-auth/src/context/create-context.ts (+6 -0)
📝 packages/core/src/types/context.ts (+10 -0)

📄 Description

What is changing?
Refactoring the internal logic to identify URLs that match a trusted domain into a context util (context.isTrustedDomain(url)), so that it can be reused in other contexts (e.g SSRF checks).

I plan to use is in a follow-up PR that will further restrict OIDC discovery and will make it less prone to SSRF attacks.

Summary by cubic

Refactored trusted origin matching into a reusable context helper and added support for dynamic trusted origins. This simplifies origin checks and strengthens validation for callback URLs, preparing for stricter OIDC discovery.

  • Refactors

    • Moved origin matching into a shared utility and exposed context.isTrustedOrigin(url, { allowRelativePaths }).
    • Simplified origin-check middleware to use the context helper and removed duplicate pattern logic.

  • New Features

    • Supports per-request trustedOrigins via an async function. Added tests and updated docs with examples, plugin usage, and a per-request warning.

Written for commit 8000cbf949. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6462 **Author:** [@jonathansamines](https://github.com/jonathansamines) **Created:** 12/1/2025 **Status:** ✅ Merged **Merged:** 12/4/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `chore/refactor-trusted-domains` --- ### 📝 Commits (10+) - [`4309910`](https://github.com/better-auth/better-auth/commit/43099105eb68b4d3f8fbb4391ca126deb02f9aba) chore(better-auth): refactor trusted domains for easier reuse - [`a5b733b`](https://github.com/better-auth/better-auth/commit/a5b733bbaa5d01cf8d7d8078e39aaff3c67e486b) Merge branch 'canary' into chore/refactor-trusted-domains - [`2870aec`](https://github.com/better-auth/better-auth/commit/2870aec4b77ad99b4e2ec792d9db4d97c2e4c628) Merge branch 'canary' into chore/refactor-trusted-domains - [`84f6cd3`](https://github.com/better-auth/better-auth/commit/84f6cd3756c3cdc04bee83cb6ab94a36cfb89d95) chore(better-auth): add tests for trusted origins helper - [`c5f2ed6`](https://github.com/better-auth/better-auth/commit/c5f2ed65b7082947ded008dfb406aca16d5032c4) docs(better-auth): add trusted origin docs - [`93703d5`](https://github.com/better-auth/better-auth/commit/93703d5af18bdeb108872511e6d664ba937431d3) chore: fix typos and docs - [`8bdac7a`](https://github.com/better-auth/better-auth/commit/8bdac7a5454d90af9fa89f28109d5a57236a2406) docs: add reference to allowRelativePaths option - [`c344f15`](https://github.com/better-auth/better-auth/commit/c344f15108ee3aa2ce58b16321b876e8adfa4834) Merge branch 'canary' into chore/refactor-trusted-domains - [`86cf320`](https://github.com/better-auth/better-auth/commit/86cf320dc49bb55f50300d8412fb12cc7b482ec1) chore: fix zod import - [`ec2ba61`](https://github.com/better-auth/better-auth/commit/ec2ba612646b934724a8b36c0bb7c6202fcdd04d) Merge branch 'canary' into chore/refactor-trusted-domains ### 📊 Changes **9 files changed** (+422 additions, -352 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/concepts/plugins.mdx` (+42 -0) 📝 `docs/content/docs/reference/security.mdx` (+18 -1) 📝 `packages/better-auth/src/api/middlewares/origin-check.test.ts` (+0 -269) 📝 `packages/better-auth/src/api/middlewares/origin-check.ts` (+11 -82) ➕ `packages/better-auth/src/auth/trusted-origins.test.ts` (+289 -0) ➕ `packages/better-auth/src/auth/trusted-origins.ts` (+45 -0) 📝 `packages/better-auth/src/context/__snapshots__/create-context.test.ts.snap` (+1 -0) 📝 `packages/better-auth/src/context/create-context.ts` (+6 -0) 📝 `packages/core/src/types/context.ts` (+10 -0) </details> ### 📄 Description **What is changing?** Refactoring the internal logic to identify URLs that match a trusted domain into a context util (`context.isTrustedDomain(url)`), so that it can be reused in other contexts (e.g SSRF checks). I plan to use is in a follow-up PR that will further restrict OIDC discovery and will make it less prone to SSRF attacks. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Refactored trusted origin matching into a reusable context helper and added support for dynamic trusted origins. This simplifies origin checks and strengthens validation for callback URLs, preparing for stricter OIDC discovery. - **Refactors** - Moved origin matching into a shared utility and exposed context.isTrustedOrigin(url, { allowRelativePaths }). - Simplified origin-check middleware to use the context helper and removed duplicate pattern logic. - **New Features** - Supports per-request trustedOrigins via an async function. Added tests and updated docs with examples, plugin usage, and a per-request warning. <sup>Written for commit 8000cbf9494a8ef22485a44a27530e4a8e30f915. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:50:41 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23584
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?