github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9060] [MERGED] fix(oauth-provider): preserve multi-valued query params through prompt redirects #25309

New Issue
Closed
opened 2026-04-15 22:49:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:49:31 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9060
Author: @gustavovalverde
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @gustavovalverde

Base: main ← Head: fix/oauth-query-array-serialization

📝 Commits (7)

  • 453cd96 fix(oauth-provider): preserve multi-valued query params through prompt redirects
  • ad5f1f8 fix: non-null assertion for strict tsconfig, bump changeset to minor
  • 93c3699 chore: changeset back to patch — this is a bug fix
  • c9f0437 chore: expand changeset with type-widening context
  • a5700e2 fix: use null-prototype object to prevent proto pollution
  • 080c381 refactor: inline query-params back into utils/index.ts
  • db7736f refactor: restore original deleteFromPrompt JSDoc to minimize diff

📊 Changes

5 files changed (+127 additions, -4 deletions)

View changed files

➕ .changeset/fix-oauth-query-array-serialization.md (+8 -0)
📝 packages/oauth-provider/src/authorize.ts (+6 -1)
📝 packages/oauth-provider/src/continue.ts (+2 -2)
📝 packages/oauth-provider/src/utils/index.ts (+16 -1)
➕ packages/oauth-provider/src/utils/query-serialization.test.ts (+95 -0)

📄 Description

serializeAuthorizationQuery used String(value) on arrays, collapsing ["a","b"] into "a,b". deleteFromPrompt and postLogin used Object.fromEntries(query), which drops all but the last value for repeated keys.

Both corrupt array-valued params during prompt redirects (login, consent, account selection, post-login).

Changes

  • serializeAuthorizationQuery: use params.append() per array element
  • deleteFromPrompt: replace Object.fromEntries() with new searchParamsToQuery() using getAll() per unique key
  • continue.ts postLogin: same Object.fromEntries() → searchParamsToQuery() fix

Unblocks #7855 (RFC 8707 resource indicators), which will need a rebase after this merges.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9060 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `main` ← **Head:** `fix/oauth-query-array-serialization` --- ### 📝 Commits (7) - [`453cd96`](https://github.com/better-auth/better-auth/commit/453cd964ba36f29fdd27ed59da1ab4d5348fb016) fix(oauth-provider): preserve multi-valued query params through prompt redirects - [`ad5f1f8`](https://github.com/better-auth/better-auth/commit/ad5f1f80ea8aa9359ffee4428d329b4587b02c79) fix: non-null assertion for strict tsconfig, bump changeset to minor - [`93c3699`](https://github.com/better-auth/better-auth/commit/93c3699e5c00ede3d567212f4a5a5da88d2c9e73) chore: changeset back to patch — this is a bug fix - [`c9f0437`](https://github.com/better-auth/better-auth/commit/c9f043723f0bc168991a0627996113a7c37be25f) chore: expand changeset with type-widening context - [`a5700e2`](https://github.com/better-auth/better-auth/commit/a5700e2d7b6fe6b1359581b97dd4e7fbdcf6d911) fix: use null-prototype object to prevent __proto__ pollution - [`080c381`](https://github.com/better-auth/better-auth/commit/080c381a50cdaee932d3387544094e1956f23300) refactor: inline query-params back into utils/index.ts - [`db7736f`](https://github.com/better-auth/better-auth/commit/db7736fb7ecf24da4160fdf62c3128bbcff1c6c5) refactor: restore original deleteFromPrompt JSDoc to minimize diff ### 📊 Changes **5 files changed** (+127 additions, -4 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/fix-oauth-query-array-serialization.md` (+8 -0) 📝 `packages/oauth-provider/src/authorize.ts` (+6 -1) 📝 `packages/oauth-provider/src/continue.ts` (+2 -2) 📝 `packages/oauth-provider/src/utils/index.ts` (+16 -1) ➕ `packages/oauth-provider/src/utils/query-serialization.test.ts` (+95 -0) </details> ### 📄 Description `serializeAuthorizationQuery` used `String(value)` on arrays, collapsing `["a","b"]` into `"a,b"`. `deleteFromPrompt` and `postLogin` used `Object.fromEntries(query)`, which drops all but the last value for repeated keys. Both corrupt array-valued params during prompt redirects (login, consent, account selection, post-login). ### Changes - `serializeAuthorizationQuery`: use `params.append()` per array element - `deleteFromPrompt`: replace `Object.fromEntries()` with new `searchParamsToQuery()` using `getAll()` per unique key - `continue.ts` `postLogin`: same `Object.fromEntries()` → `searchParamsToQuery()` fix Unblocks #7855 (RFC 8707 resource indicators), which will need a rebase after this merges. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:49:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25309
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?