github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7567] [MERGED] feat(sso): add IdP-initiated SAML Single Logout (SLO) #24307

New Issue
Closed
opened 2026-04-15 22:17:55 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:17:55 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7567
Author: @Paola3stefania
Created: 1/23/2026
Status: ✅ Merged
Merged: 2/13/2026
Merged by: @himself65

Base: canary ← Head: feat/saml-single-logout

📝 Commits (10+)

  • 432cf05 feat: idp logout
  • b6f1ce8 make lint happy
  • 0a08ab5 feat: initiate SLO
  • 2da7191 feat: handlelogout
  • eeffbe9 feat: SP metadata includes SingleLogoutService
  • baee021 jsonparse and clear session cookie
  • 4f22a2b tests
  • 6f03fe2 merge: integrate parent branch changes
  • 0de6b90 fix deletion logic
  • 512fb60 Merge branch 'feat/saml-single-logout' into feat/saml-slo-sp-initiated

📊 Changes

7 files changed (+1345 additions, -41 deletions)

View changed files

📝 packages/sso/src/constants.ts (+21 -0)
📝 packages/sso/src/index.ts (+39 -2)
➕ packages/sso/src/routes/helpers.ts (+126 -0)
📝 packages/sso/src/routes/sso.ts (+523 -39)
📝 packages/sso/src/saml.test.ts (+582 -0)
➕ packages/sso/src/saml/error-codes.ts (+11 -0)
📝 packages/sso/src/types.ts (+43 -0)

📄 Description

IdP                              Our SP (sloEndpoint)
 │                                      │
 │  1. LogoutRequest ─────────────────► │
 │                                      │ 2. Parse request
 │                                      │ 3. Delete session
 │  ◄───────────────── 4. LogoutResponse│
 │                                      │

Along with https://github.com/better-auth/better-auth/pull/7568 addresses https://github.com/better-auth/better-auth/issues/6610 and https://github.com/better-auth/better-auth/pull/7569

Summary by cubic

Adds SAML Single Logout (SLO) for both IdP- and SP-initiated flows. Sessions and SAML mappings are cleaned up, cookies are cleared, and SP metadata advertises SLO when enabled.

  • New Features

    • Endpoints: /sso/saml2/sp/slo/:providerId (GET/POST) and /sso/saml2/logout/:providerId (POST).
    • Controlled by options.saml.enableSingleLogout (+ wantLogoutRequestSigned, wantLogoutResponseSigned, logoutRequestTTL).
    • Tracks SAML sessions (NameID/SessionIndex ↔ sessionId); validates SessionIndex; cleans lookups on /sign-out; bypasses origin checks for SLO.
    • SP metadata includes SingleLogoutService (POST/Redirect) when enabled; validates IdP SLO support before SP-initiated logout.
    • Validates LogoutRequest/LogoutResponse (incl. inResponseTo and status code); clears session cookie; safe RelayState redirects; tests cover SP/IdP flows, metadata, CSRF bypass, and error cases.

  • Refactors

    • Extracted helpers: createSP, createIdP, findSAMLProvider, createSAMLPostForm.
    • Centralized constants/TTLs and status (SAML_STATUS_SUCCESS, SAML_SESSION_KEY_PREFIX, SAML_SESSION_BY_ID_PREFIX, LOGOUT_REQUEST_KEY_PREFIX); added SAML error codes; safer JSON/RelayState handling; used deleteSessionCookie; tightened SAML assertion types.

Written for commit 41b72f6590. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7567 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 1/23/2026 **Status:** ✅ Merged **Merged:** 2/13/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/saml-single-logout` --- ### 📝 Commits (10+) - [`432cf05`](https://github.com/better-auth/better-auth/commit/432cf05f71d29f972d7d30e73b07377ee147a86d) feat: idp logout - [`b6f1ce8`](https://github.com/better-auth/better-auth/commit/b6f1ce82ae291f85e10ef40bfa213adc33c00340) make lint happy - [`0a08ab5`](https://github.com/better-auth/better-auth/commit/0a08ab5e98aec592e18d6a08c60f293a13ed0f4c) feat: initiate SLO - [`2da7191`](https://github.com/better-auth/better-auth/commit/2da719116c3b1fd52eb54782286e64dc86969fbc) feat: handlelogout - [`eeffbe9`](https://github.com/better-auth/better-auth/commit/eeffbe9d3d3d03b089f6f1d9ac4c9a0ca755b766) feat: SP metadata includes SingleLogoutService - [`baee021`](https://github.com/better-auth/better-auth/commit/baee021c9fe387342fe10fb438436d420adadf02) jsonparse and clear session cookie - [`4f22a2b`](https://github.com/better-auth/better-auth/commit/4f22a2b92752577dcc6591bc25e784b3c03b0398) tests - [`6f03fe2`](https://github.com/better-auth/better-auth/commit/6f03fe24ae9995d55f81c28385ff016124017e9f) merge: integrate parent branch changes - [`0de6b90`](https://github.com/better-auth/better-auth/commit/0de6b90c12074d66419889f38a4e7b57f81c8850) fix deletion logic - [`512fb60`](https://github.com/better-auth/better-auth/commit/512fb60be15aea9000965616bc46064d9483c599) Merge branch 'feat/saml-single-logout' into feat/saml-slo-sp-initiated ### 📊 Changes **7 files changed** (+1345 additions, -41 deletions) <details> <summary>View changed files</summary> 📝 `packages/sso/src/constants.ts` (+21 -0) 📝 `packages/sso/src/index.ts` (+39 -2) ➕ `packages/sso/src/routes/helpers.ts` (+126 -0) 📝 `packages/sso/src/routes/sso.ts` (+523 -39) 📝 `packages/sso/src/saml.test.ts` (+582 -0) ➕ `packages/sso/src/saml/error-codes.ts` (+11 -0) 📝 `packages/sso/src/types.ts` (+43 -0) </details> ### 📄 Description ``` IdP Our SP (sloEndpoint) │ │ │ 1. LogoutRequest ─────────────────► │ │ │ 2. Parse request │ │ 3. Delete session │ ◄───────────────── 4. LogoutResponse│ │ │ ``` Along with https://github.com/better-auth/better-auth/pull/7568 addresses https://github.com/better-auth/better-auth/issues/6610 and https://github.com/better-auth/better-auth/pull/7569 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds SAML Single Logout (SLO) for both IdP- and SP-initiated flows. Sessions and SAML mappings are cleaned up, cookies are cleared, and SP metadata advertises SLO when enabled. - **New Features** - Endpoints: /sso/saml2/sp/slo/:providerId (GET/POST) and /sso/saml2/logout/:providerId (POST). - Controlled by options.saml.enableSingleLogout (+ wantLogoutRequestSigned, wantLogoutResponseSigned, logoutRequestTTL). - Tracks SAML sessions (NameID/SessionIndex ↔ sessionId); validates SessionIndex; cleans lookups on /sign-out; bypasses origin checks for SLO. - SP metadata includes SingleLogoutService (POST/Redirect) when enabled; validates IdP SLO support before SP-initiated logout. - Validates LogoutRequest/LogoutResponse (incl. inResponseTo and status code); clears session cookie; safe RelayState redirects; tests cover SP/IdP flows, metadata, CSRF bypass, and error cases. - **Refactors** - Extracted helpers: createSP, createIdP, findSAMLProvider, createSAMLPostForm. - Centralized constants/TTLs and status (SAML_STATUS_SUCCESS, SAML_SESSION_KEY_PREFIX, SAML_SESSION_BY_ID_PREFIX, LOGOUT_REQUEST_KEY_PREFIX); added SAML error codes; safer JSON/RelayState handling; used deleteSessionCookie; tightened SAML assertion types. <sup>Written for commit 41b72f6590ce9af02e528601dcb5bb995e22a4cc. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:17:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#24307
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?