github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #2360] Invalid scope error even after setting scopes array #26487

New Issue
Closed
opened 2026-04-17 17:04:48 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-17 17:04:48 -05:00
Owner
Copy Link

Originally created by @amal-chandran on GitHub (Apr 19, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/2360

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Current vs. Expected behavior

Current behavior
Image

Even after setting the scopes its not used while creating the redirect url
The default fallback is used always where offline_access is one of the scope which is not part of clerks scopes

Image
Image

Expected

Note:
When i removed the offline_access by directly modifiying the installed lib it started working

What version of Better Auth are you using?

^1.2.7

Provide environment information

System:
    OS: Linux 6.5 elementary OS 7.1 Horus 7.1 Horus
    CPU: (16) x64 AMD Ryzen 7 5800H with Radeon Graphics
    Memory: 16.11 GB / 27.25 GB
    Container: Yes
    Shell: 5.8.1 - /usr/bin/zsh
  Binaries:
    Node: 20.15.0 - ~/.nvm/versions/node/v20.15.0/bin/node
    npm: 10.8.1 - ~/.nvm/versions/node/v20.15.0/bin/npm
    bun: 1.1.29 - ~/.bun/bin/bun
  Managers:
    Apt: 2.4.12 - /usr/bin/apt
    Cargo: 1.81.0 - ~/.cargo/bin/cargo
    Homebrew: 4.4.10 - /home/linuxbrew/.linuxbrew/bin/brew
    pip3: 22.0.2 - /usr/bin/pip3
  Utilities:
    CMake: 3.22.1 - /usr/bin/cmake
    Make: 4.3 - /usr/bin/make
    GCC: 11.4.0 - /usr/bin/gcc
    Git: 2.34.1 - /usr/bin/git
    Clang: 14.0.0 - /usr/bin/clang
    Ninja: 1.10.1 - /usr/bin/ninja
    FFmpeg: 4.4.2 - /usr/bin/ffmpeg
    Curl: 7.81.0 - /usr/bin/curl
    OpenSSL: 3.0.2 - /usr/bin/openssl
  Virtualization:
    Docker: 27.0.3 - /usr/bin/docker
    VirtualBox: 7.0.18 - /usr/bin/vboxmanage
  IDEs:
    Nano: 6.2 - /usr/bin/nano
    VSCode: 1.97.0 - /home/amalc/.local/bin/code
  Languages:
    Bash: 5.1.16 - /usr/bin/bash
    Java: 17.0.13 - /usr/bin/javac
    Perl: 5.34.0 - /usr/bin/perl
    Python3: 3.10.13 - /usr/bin/python3
    Rust: 1.81.0 - /home/amalc/.cargo/bin/rustc
  Databases:
    MySQL: 0.22.04.1 - /usr/bin/mysql
    SQLite: 3.44.3 - /home/amalc/Android/Sdk/platform-tools/sqlite3
  Browsers:
    Brave Browser: 126.1.67.123
    Chrome: 133.0.6943.141

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @amal-chandran on GitHub (Apr 19, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/2360 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce - Clone the repo and run the app as mentioned in readme - https://github.com/amal-chandran/sso-better-auth ### Current vs. Expected behavior Current behavior ![Image](https://github.com/user-attachments/assets/de613660-1da8-4f78-92dc-0804f227c9da) Even after setting the scopes its not used while creating the redirect url The default fallback is used always where offline_access is one of the scope which is not part of clerks scopes ![Image](https://github.com/user-attachments/assets/bef4fd19-3b83-4dbd-b0d3-86374335ecf3) ![Image](https://github.com/user-attachments/assets/b88039fb-01da-4b0b-a8db-f9f566277007) Expected - If we set the scopes that should be followed while creating the redirect url - ref: https://github.com/better-auth/better-auth/blob/3f574ec70bb15c155a78673d42c5e25f7376ced3/packages/better-auth/src/plugins/sso/index.ts#L606-L611 Note: When i removed the offline_access by directly modifiying the installed lib it started working ### What version of Better Auth are you using? ^1.2.7 ### Provide environment information ```bash System: OS: Linux 6.5 elementary OS 7.1 Horus 7.1 Horus CPU: (16) x64 AMD Ryzen 7 5800H with Radeon Graphics Memory: 16.11 GB / 27.25 GB Container: Yes Shell: 5.8.1 - /usr/bin/zsh Binaries: Node: 20.15.0 - ~/.nvm/versions/node/v20.15.0/bin/node npm: 10.8.1 - ~/.nvm/versions/node/v20.15.0/bin/npm bun: 1.1.29 - ~/.bun/bin/bun Managers: Apt: 2.4.12 - /usr/bin/apt Cargo: 1.81.0 - ~/.cargo/bin/cargo Homebrew: 4.4.10 - /home/linuxbrew/.linuxbrew/bin/brew pip3: 22.0.2 - /usr/bin/pip3 Utilities: CMake: 3.22.1 - /usr/bin/cmake Make: 4.3 - /usr/bin/make GCC: 11.4.0 - /usr/bin/gcc Git: 2.34.1 - /usr/bin/git Clang: 14.0.0 - /usr/bin/clang Ninja: 1.10.1 - /usr/bin/ninja FFmpeg: 4.4.2 - /usr/bin/ffmpeg Curl: 7.81.0 - /usr/bin/curl OpenSSL: 3.0.2 - /usr/bin/openssl Virtualization: Docker: 27.0.3 - /usr/bin/docker VirtualBox: 7.0.18 - /usr/bin/vboxmanage IDEs: Nano: 6.2 - /usr/bin/nano VSCode: 1.97.0 - /home/amalc/.local/bin/code Languages: Bash: 5.1.16 - /usr/bin/bash Java: 17.0.13 - /usr/bin/javac Perl: 5.34.0 - /usr/bin/perl Python3: 3.10.13 - /usr/bin/python3 Rust: 1.81.0 - /home/amalc/.cargo/bin/rustc Databases: MySQL: 0.22.04.1 - /usr/bin/mysql SQLite: 3.44.3 - /home/amalc/Android/Sdk/platform-tools/sqlite3 Browsers: Brave Browser: 126.1.67.123 Chrome: 133.0.6943.141 ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-17 17:04:48 -05:00
GiteaMirror commented 2026-04-17 17:04:50 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Apr 20, 2025):

You mention Clerk and Oauth?
I don't see that you're using anything oauth related in your auth config, also not sure how Clerk is related.
Could you fill me in?

<!-- gh-comment-id:2817047387 --> @ping-maxwell commented on GitHub (Apr 20, 2025): You mention Clerk and Oauth? I don't see that you're using anything oauth related in your auth config, also not sure how Clerk is related. Could you fill me in?
GiteaMirror commented 2026-04-17 17:04:51 -05:00
Author
Owner
Copy Link

@amal-chandran commented on GitHub (Apr 20, 2025):

<!-- gh-comment-id:2817160964 --> @amal-chandran commented on GitHub (Apr 20, 2025): - I was trying to use clerk as IDP based on these docs https://clerk.com/docs/advanced-usage/clerk-idp - As per the docs we need to create an oauth app for same thats how we can grab the client_id & client_secret - Then i used the same to register the sso provider - https://www.better-auth.com/docs/plugins/sso#register-an-oidc-provider - For my use case i used wrong approch as per the discussion - https://discord.com/channels/1288403910284935179/1363058816081723502/1363058816081723502 - The issue is still valid i think
GiteaMirror commented 2026-04-17 17:04:52 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Apr 20, 2025):

The offline_access scope is the standardized way to ask for refresh tokens. See the relevant OpenID Connect Core spec.

We can probably have some patch for you, but it feels like a loophole out-of-spec.
Ideally this should be fixed on Clerk's side.
@Bekacru wdyt?

<!-- gh-comment-id:2817170573 --> @ping-maxwell commented on GitHub (Apr 20, 2025): The `offline_access` scope is the standardized way to ask for refresh tokens. See [the relevant OpenID Connect Core spec](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess). We can probably have some patch for you, but it feels like a loophole out-of-spec. Ideally this should be fixed on Clerk's side. @Bekacru wdyt?
GiteaMirror commented 2026-04-17 17:04:53 -05:00
Author
Owner
Copy Link

@amal-chandran commented on GitHub (Apr 24, 2025):

You're right — the scope handling is currently missing, and Clerk should ideally handle that as part of the implementation.

There might be cases where some systems do not include all the standard scopes. In such scenarios, users should have the ability to remove or override certain default scopes.

From what I understand, if we correctly load the scopes provided by the user, everything should function as expected.
Reference: better-auth SSO plugin implementation

<!-- gh-comment-id:2826395776 --> @amal-chandran commented on GitHub (Apr 24, 2025): You're right — the scope handling is currently missing, and Clerk should ideally handle that as part of the implementation. There might be cases where some systems do not include all the standard scopes. In such scenarios, users should have the ability to remove or override certain default scopes. From what I understand, if we correctly load the scopes provided by the user, everything should function as expected. Reference: [better-auth SSO plugin implementation](https://github.com/better-auth/better-auth/blob/3f574ec70bb15c155a78673d42c5e25f7376ced3/packages/better-auth/src/plugins/sso/index.ts#L606-L611)
GiteaMirror commented 2026-04-17 17:04:54 -05:00
Author
Owner
Copy Link

@handlebauer commented on GitHub (May 15, 2025):

I agree that upstream vendors should probably be handling the standard scopes better but I think better-auth would do better to give the user flexibility on this. You can configure the oidc_config scopes (via the sso_provider table) but it doesn't seem like those scopes are being respected currently (sends offline_access regardless because ctx.body.scopes is undefined). I don't have anywhere near full-context on this so I may very well be wrong about who should be responsible for what here but it's at the very least confusing as a consumer of this library.

<!-- gh-comment-id:2884572603 --> @handlebauer commented on GitHub (May 15, 2025): I agree that upstream vendors should probably be handling the standard scopes better but I think better-auth would do better to give the user flexibility on this. You can configure the `oidc_config` scopes (via the `sso_provider` table) but it doesn't seem like those scopes are being respected currently (sends `offline_access` regardless because `ctx.body.scopes` is `undefined`). I don't have anywhere near full-context on this so I may very well be wrong about who should be responsible for what here but it's at the very least confusing as a consumer of this library.
GiteaMirror commented 2026-04-17 17:04:55 -05:00
Author
Owner
Copy Link

@arunavo4 commented on GitHub (Jul 26, 2025):

This seems to be an issue, we need to be able to pass the scopes.

<!-- gh-comment-id:3122174075 --> @arunavo4 commented on GitHub (Jul 26, 2025): This seems to be an issue, we need to be able to pass the scopes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#26487
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?