github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6722] [MERGED] fix(saml): acs origin check & update skipOriginCheck to boolean | string[] #23751

New Issue
Closed
opened 2026-04-15 21:57:14 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:57:14 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6722
Author: @Paola3stefania
Created: 12/12/2025
Status: ✅ Merged
Merged: 1/13/2026
Merged by: @himself65

Base: fix/saml-idp-callback-routing ← Head: fix/saml-acs-origin-check

📝 Commits (10+)

  • 90ecc07 feat: normalized shared func
  • 2a78758 feat: add skipOriginCheckForPaths
  • f68997f feat: add init hook to register saml paths
  • 7abae2a improve logic
  • df68f66 Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check
  • ea3e89b fix: test
  • cd0a9eb Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check
  • a7e4ca2 rename: skipOriginCheck: string[] | boolean
  • b55bfa3 make lint happy
  • 66a1581 Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check

📊 Changes

9 files changed (+315 additions, -21 deletions)

View changed files

📝 packages/better-auth/src/api/index.ts (+2 -8)
📝 packages/better-auth/src/api/middlewares/origin-check.ts (+19 -1)
📝 packages/better-auth/src/api/rate-limiter/index.ts (+3 -3)
📝 packages/better-auth/src/context/create-context.ts (+3 -1)
📝 packages/better-auth/src/context/helpers.ts (+1 -1)
📝 packages/better-auth/src/utils/url.ts (+44 -0)
📝 packages/core/src/types/context.ts (+8 -7)
📝 packages/sso/src/index.ts (+22 -0)
📝 packages/sso/src/saml.test.ts (+213 -0)

📄 Description

Summary by cubic

Fixes SAML ACS/callback origin validation so IdP POSTs don’t fail CSRF checks. Also separates CSRF and origin checks for clearer control.

  • Bug Fixes

    • Skip origin checks for SAML callback and ACS paths using prefix matching (e.g., /sso/saml2/callback, /sso/saml2/sp/acs).
    • Normalize request paths with basePath in router, rate limiter, and origin middleware for consistent matching.
    • Set Location headers on redirecting responses (social sign-in and account linking) to ensure proper redirects.

  • New Features

    • Origin middleware adds path-based skip lists (boolean or string[]) and Fetch Metadata protection for first-login/form POSTs; SSO plugin registers SAML paths at init.
    • Separate advanced options: disableCSRFCheck and disableOriginCheck, with backward-compatible behavior.

Written for commit 0a0ef42cdf. Summary will update on new commits.

If https://github.com/better-auth/better-auth/pull/6719 gets merged before this,. re arrange constants, and saml server tests

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6722 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/12/2025 **Status:** ✅ Merged **Merged:** 1/13/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `fix/saml-idp-callback-routing` ← **Head:** `fix/saml-acs-origin-check` --- ### 📝 Commits (10+) - [`90ecc07`](https://github.com/better-auth/better-auth/commit/90ecc0788ad113eb7629ba665bb22dabe53bec6a) feat: normalized shared func - [`2a78758`](https://github.com/better-auth/better-auth/commit/2a78758ba071ad002a937161cb6819b640b83ea5) feat: add skipOriginCheckForPaths - [`f68997f`](https://github.com/better-auth/better-auth/commit/f68997f0015de8c11e2fc8479f53dacb89ab39d9) feat: add init hook to register saml paths - [`7abae2a`](https://github.com/better-auth/better-auth/commit/7abae2a84cb91cd5f15db3ca305ce8118cb7b229) improve logic - [`df68f66`](https://github.com/better-auth/better-auth/commit/df68f668d861529e4a8da3c3574fae3679ca316d) Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check - [`ea3e89b`](https://github.com/better-auth/better-auth/commit/ea3e89bb4d989f732a1adbebbd9446ccaf17629c) fix: test - [`cd0a9eb`](https://github.com/better-auth/better-auth/commit/cd0a9eb39386d07f8bf28209600b84e9244da981) Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check - [`a7e4ca2`](https://github.com/better-auth/better-auth/commit/a7e4ca266c14efb3355737450161cd1538922b23) rename: skipOriginCheck: string[] | boolean - [`b55bfa3`](https://github.com/better-auth/better-auth/commit/b55bfa36a8aea70c79fd7b06d380fe4c4b56eb75) make lint happy - [`66a1581`](https://github.com/better-auth/better-auth/commit/66a1581273bf4eadf14233572bcf505c7f1186b2) Merge branch 'fix/saml-idp-callback-routing' into fix/saml-acs-origin-check ### 📊 Changes **9 files changed** (+315 additions, -21 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/index.ts` (+2 -8) 📝 `packages/better-auth/src/api/middlewares/origin-check.ts` (+19 -1) 📝 `packages/better-auth/src/api/rate-limiter/index.ts` (+3 -3) 📝 `packages/better-auth/src/context/create-context.ts` (+3 -1) 📝 `packages/better-auth/src/context/helpers.ts` (+1 -1) 📝 `packages/better-auth/src/utils/url.ts` (+44 -0) 📝 `packages/core/src/types/context.ts` (+8 -7) 📝 `packages/sso/src/index.ts` (+22 -0) 📝 `packages/sso/src/saml.test.ts` (+213 -0) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixes SAML ACS/callback origin validation so IdP POSTs don’t fail CSRF checks. Also separates CSRF and origin checks for clearer control. - **Bug Fixes** - Skip origin checks for SAML callback and ACS paths using prefix matching (e.g., /sso/saml2/callback, /sso/saml2/sp/acs). - Normalize request paths with basePath in router, rate limiter, and origin middleware for consistent matching. - Set Location headers on redirecting responses (social sign-in and account linking) to ensure proper redirects. - **New Features** - Origin middleware adds path-based skip lists (boolean or string[]) and Fetch Metadata protection for first-login/form POSTs; SSO plugin registers SAML paths at init. - Separate advanced options: disableCSRFCheck and disableOriginCheck, with backward-compatible behavior. <sup>Written for commit 0a0ef42cdf2021448eca952d257993852b4f589b. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> If https://github.com/better-auth/better-auth/pull/6719 gets merged before this,. re arrange constants, and saml server tests --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:57:14 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23751
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?