github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6549] [CLOSED] fix(sso): safely parse provider configs on registration x #23639

New Issue
Closed
opened 2026-04-15 21:52:55 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:52:55 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6549
Author: @Paola3stefania
Created: 12/5/2025
Status: ❌ Closed

Base: canary ← Head: fix/sso-provider-config-parse

📝 Commits (10+)

📊 Changes

9 files changed (+1771 additions, -74 deletions)

View changed files

📝 docs/content/docs/concepts/users-accounts.mdx (+33 -2)
📝 docs/content/docs/plugins/sso.mdx (+49 -1)
📝 packages/better-auth/src/oauth2/link-account.test.ts (+354 -0)
📝 packages/better-auth/src/oauth2/link-account.ts (+57 -10)
📝 packages/core/src/types/init-options.ts (+33 -0)
➕ packages/sso/src/account-linking.test.ts (+620 -0)
📝 packages/sso/src/routes/sso.ts (+97 -60)
📝 packages/sso/src/saml.test.ts (+431 -0)
📝 packages/sso/src/utils.ts (+97 -1)

📄 Description

Summary by cubic

Safely parse SSO provider configs during registration to avoid JSON/string issues and return proper objects. Also hardens SSO auto-linking with a clear linkingPolicy and stricter trust checks to prevent unintended account linking.

  • New Features

    • Added account.accountLinking.linkingPolicy: "never" | "trusted_providers_only" | "verified_email_trusted" (default).
    • SSO enforces trust: auto-link only if provider is in trustedProviders or the provider’s domain is verified and matches the user’s email domain; otherwise redirects with ?error=account_not_linked.
    • Introduced canAutoLinkExistingUser helper and skipTrustCheck to avoid duplicate checks; added banned-user handling on sign-in.
    • Docs updated with recommended policies and SSO behavior.

  • Bug Fixes

    • Safely parse OIDC/SAML configs in registerSSOProvider using safeJsonParse; responses now include real objects (no “[object Object]”) and work with JSON or object values from the DB.
    • Unified, consistent account-linking enforcement across OIDC and SAML; added comprehensive tests for policies, domain verification, and config parsing.

Written for commit 7ae9bb53f1. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6549 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/5/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `fix/sso-provider-config-parse` --- ### 📝 Commits (10+) - [`c7e2cfd`](https://github.com/better-auth/better-auth/commit/c7e2cfda1c18943233f01dd34425cab13da4c882) feat: account linking - [`001c347`](https://github.com/better-auth/better-auth/commit/001c347286560a7c33ab58f853849739fe522e67) docs: update - [`94cce31`](https://github.com/better-auth/better-auth/commit/94cce311b9dbb4c2e788dd5d8158e68e48213897) fix(deps): update dependency next to v16.0.7 [security] (#6501) - [`e46a957`](https://github.com/better-auth/better-auth/commit/e46a95770a276aa05848b3126890af3c4f651957) test: fix regression test for generateId: false scenario (#6493) - [`69f966f`](https://github.com/better-auth/better-auth/commit/69f966f0c6cfcda4b8ac382578a1c366522122b8) fix(cli): `secret` generates empty (#6504) - [`9c76e1b`](https://github.com/better-auth/better-auth/commit/9c76e1b4a6929c5824f68a2a71b518014d53b2a0) chore: more unit tests for api-key (#6499) - [`db8efd4`](https://github.com/better-auth/better-auth/commit/db8efd464ed48d31c2ab15922f16b60c0c11b617) chore: cleanup prisma deps (#6505) - [`45c1d14`](https://github.com/better-auth/better-auth/commit/45c1d14c024f8b4e6ad0c4afdb33d2ce28ed8853) refactor: move `capitalizeFirstLetter` to core (#6506) - [`f6a513b`](https://github.com/better-auth/better-auth/commit/f6a513bfe5a6c766b0d26fcc669a62d5770566c1) chore: bump react (#6508) - [`d6337c0`](https://github.com/better-auth/better-auth/commit/d6337c04ac3a85716b7e9de9cbbce1184ecae4b9) feat: backwards compatibility ### 📊 Changes **9 files changed** (+1771 additions, -74 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/concepts/users-accounts.mdx` (+33 -2) 📝 `docs/content/docs/plugins/sso.mdx` (+49 -1) 📝 `packages/better-auth/src/oauth2/link-account.test.ts` (+354 -0) 📝 `packages/better-auth/src/oauth2/link-account.ts` (+57 -10) 📝 `packages/core/src/types/init-options.ts` (+33 -0) ➕ `packages/sso/src/account-linking.test.ts` (+620 -0) 📝 `packages/sso/src/routes/sso.ts` (+97 -60) 📝 `packages/sso/src/saml.test.ts` (+431 -0) 📝 `packages/sso/src/utils.ts` (+97 -1) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Safely parse SSO provider configs during registration to avoid JSON/string issues and return proper objects. Also hardens SSO auto-linking with a clear linkingPolicy and stricter trust checks to prevent unintended account linking. - **New Features** - Added account.accountLinking.linkingPolicy: "never" | "trusted_providers_only" | "verified_email_trusted" (default). - SSO enforces trust: auto-link only if provider is in trustedProviders or the provider’s domain is verified and matches the user’s email domain; otherwise redirects with ?error=account_not_linked. - Introduced canAutoLinkExistingUser helper and skipTrustCheck to avoid duplicate checks; added banned-user handling on sign-in. - Docs updated with recommended policies and SSO behavior. - **Bug Fixes** - Safely parse OIDC/SAML configs in registerSSOProvider using safeJsonParse; responses now include real objects (no “[object Object]”) and work with JSON or object values from the DB. - Unified, consistent account-linking enforcement across OIDC and SAML; added comprehensive tests for policies, domain verification, and config parsing. <sup>Written for commit 7ae9bb53f14744745a2cca3a1152284eda66b578. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> ---------- --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:52:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23639
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?