github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8082] [MERGED] fix(oauth-proxy): add generic OAuth support to proxy #24632

New Issue
Closed
opened 2026-04-15 22:29:00 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:29:00 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8082
Author: @Diabl0570
Created: 2/20/2026
Status: ✅ Merged
Merged: 2/28/2026
Merged by: @Bekacru

Base: canary ← Head: fix/oauth-proxy-generic-oauth

📝 Commits (7)

  • 3d3435b fix(oauth-proxy): add generic OAuth support to proxy
  • 7a2b64b poc: fixing the invalid code error
  • aaee238 feat(oauth-proxy): enhance OAuth callback handling and add tests for generic provider
  • 29d52ac Merge branch 'canary' into fix/oauth-proxy-generic-oauth
  • 4d5c162 fix(oauth-proxy): improve callback URI handling for OAuth tokens
  • e79a76d fix(generic-oauth): include codeVerifier in token retrieval and validation
  • 7c86052 Merge branch 'canary' into fix/oauth-proxy-generic-oauth

📊 Changes

5 files changed (+145 additions, -12 deletions)

View changed files

📝 packages/better-auth/src/plugins/generic-oauth/index.ts (+9 -3)
📝 packages/better-auth/src/plugins/generic-oauth/routes.ts (+8 -3)
📝 packages/better-auth/src/plugins/oauth-proxy/index.ts (+17 -4)
📝 packages/better-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts (+109 -0)
📝 packages/better-auth/src/state.ts (+2 -2)

📄 Description

Coming from the discussion in https://github.com/better-auth/better-auth/issues/7141
and the example repo https://github.com/bytaesu/ba-oauth-proxy-example
, the provided examples do not work with the generic OAuth provider.

This PR updates the oauth-proxy so it should also support generic OAuth providers.

This change still needs to be fully verified. Publishing a deployed package makes it easier to test this in a real deployed environment.

Summary by cubic

Adds generic OAuth support to the oauth-proxy and ensures redirect_uri matches the real callback URL to prevent invalid_code errors. Adds PKCE codeVerifier handling, unifies callback matching, and fixes state cleanup for UUID/database mode.

  • New Features

    • Unified matcher intercepts both /oauth2/callback/:providerId and /callback/:id.
    • Accepts providerId from :id or :providerId.
    • Builds redirect_uri from the request URL (origin + pathname) with a baseURL fallback that picks the correct callback path.

  • Bug Fixes

    • Use callback redirectURI for token exchange and pass PKCE codeVerifier to getToken/validateAuthorizationCode.
    • parseGenericState deletes verification by identifier to support UUIDs and database mode.
    • Added tests for generic provider intercept and same-origin handling; improved error logging.

Written for commit 7c860528d8. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8082 **Author:** [@Diabl0570](https://github.com/Diabl0570) **Created:** 2/20/2026 **Status:** ✅ Merged **Merged:** 2/28/2026 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `fix/oauth-proxy-generic-oauth` --- ### 📝 Commits (7) - [`3d3435b`](https://github.com/better-auth/better-auth/commit/3d3435b32ded72482fbe0d2fc917d5d6857647d1) fix(oauth-proxy): add generic OAuth support to proxy - [`7a2b64b`](https://github.com/better-auth/better-auth/commit/7a2b64beba2432292019f3bd4b8224313f6a6d03) poc: fixing the invalid code error - [`aaee238`](https://github.com/better-auth/better-auth/commit/aaee238fd9369667e79bc2d85235dc017eea0c60) feat(oauth-proxy): enhance OAuth callback handling and add tests for generic provider - [`29d52ac`](https://github.com/better-auth/better-auth/commit/29d52acf1fedcb0332c926430f7d5178fde6bc8f) Merge branch 'canary' into fix/oauth-proxy-generic-oauth - [`4d5c162`](https://github.com/better-auth/better-auth/commit/4d5c1627f9b098feb1ed2b4208e251aaa6ab1107) fix(oauth-proxy): improve callback URI handling for OAuth tokens - [`e79a76d`](https://github.com/better-auth/better-auth/commit/e79a76d9fa0e6a150cd6b259b45c1318ff35cfd3) fix(generic-oauth): include codeVerifier in token retrieval and validation - [`7c86052`](https://github.com/better-auth/better-auth/commit/7c860528d8af98fc470ccef388b36d952747d733) Merge branch 'canary' into fix/oauth-proxy-generic-oauth ### 📊 Changes **5 files changed** (+145 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/generic-oauth/index.ts` (+9 -3) 📝 `packages/better-auth/src/plugins/generic-oauth/routes.ts` (+8 -3) 📝 `packages/better-auth/src/plugins/oauth-proxy/index.ts` (+17 -4) 📝 `packages/better-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts` (+109 -0) 📝 `packages/better-auth/src/state.ts` (+2 -2) </details> ### 📄 Description Coming from the discussion in https://github.com/better-auth/better-auth/issues/7141 and the example repo https://github.com/bytaesu/ba-oauth-proxy-example , the provided examples do not work with the generic OAuth provider. This PR updates the oauth-proxy so it should also support generic OAuth providers. This change still needs to be fully verified. Publishing a deployed package makes it easier to test this in a real deployed environment. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds generic OAuth support to the oauth-proxy and ensures redirect_uri matches the real callback URL to prevent invalid_code errors. Adds PKCE codeVerifier handling, unifies callback matching, and fixes state cleanup for UUID/database mode. - **New Features** - Unified matcher intercepts both /oauth2/callback/:providerId and /callback/:id. - Accepts providerId from :id or :providerId. - Builds redirect_uri from the request URL (origin + pathname) with a baseURL fallback that picks the correct callback path. - **Bug Fixes** - Use callback redirectURI for token exchange and pass PKCE codeVerifier to getToken/validateAuthorizationCode. - parseGenericState deletes verification by identifier to support UUIDs and database mode. - Added tests for generic provider intercept and same-origin handling; improved error logging. <sup>Written for commit 7c860528d8af98fc470ccef388b36d952747d733. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:29:00 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#24632
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?