github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-20 20:26:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #9180] tracking: generic-oauth + social provider config surface #28621

New Issue
Open
opened 2026-04-17 20:03:15 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 20:03:15 -05:00
Owner
Copy Link
Copy Source

Originally created by @gustavovalverde on GitHub (Apr 14, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/9180

Summary

The consumer-side provider configuration in genericOAuth and socialProviders behaves differently across authorize, token, refresh, userinfo, and link stages. The open sub-issues describe missing hooks, inconsistent parameter handling, and provider-specific override paths that do not follow one contract. Callback errors and profile mapping behavior also vary by provider and flow.

Root cause

The current configuration surface grew stage by stage, and equivalent operations do not share equivalent options. Some providers ignore authorizationUrlParams, while refresh flows do not expose a parallel parameter path. clientSecret and other provider settings cannot always resolve asynchronously or from request context. Link flows do not consistently update or enrich profile data. Userinfo overrides and provider-specific profile shapes require inline workarounds instead of using a shared contract. Callback parsing can also fail on non-ASCII error_description values.

Scope

In: the genericOAuth and socialProviders config shape, covering all request stages; the provider-callback error surface; profile/claim mapping hooks on link and update.

Out: issuer-side OAuth (see tracking: oauth-provider conformance). SSO plugin (see tracking: SSO plugin). OAuth state cookie writes (see OAuth state_mismatch cluster).

Resolution criteria

  • One config type covers authorize, token, refresh, userinfo, link with parallel shape.
  • clientSecret and any stage URL/params accept a function of (context, request).
  • Every provider-callback error surfaces a structured error payload without crashing on non-ASCII.
  • mapProfileToUser updates on every link and sign-in, not only on first create.
  • Provider-specific shapes (Cognito, Entra personal, Twitch refresh, etc.) are handled by the core contract, not inline overrides.

Related

  • An RFC issue (or PR) defining the target config type closes most of the list in a single pass.
  • Type related: no single fix closes everything, but the RFC should name which existing issues become obsolete.
Originally created by @gustavovalverde on GitHub (Apr 14, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/9180 ## Summary The consumer-side provider configuration in `genericOAuth` and `socialProviders` behaves differently across `authorize`, `token`, `refresh`, `userinfo`, and `link` stages. The open sub-issues describe missing hooks, inconsistent parameter handling, and provider-specific override paths that do not follow one contract. Callback errors and profile mapping behavior also vary by provider and flow. ## Root cause The current configuration surface grew stage by stage, and equivalent operations do not share equivalent options. Some providers ignore `authorizationUrlParams`, while refresh flows do not expose a parallel parameter path. `clientSecret` and other provider settings cannot always resolve asynchronously or from request context. Link flows do not consistently update or enrich profile data. Userinfo overrides and provider-specific profile shapes require inline workarounds instead of using a shared contract. Callback parsing can also fail on non-ASCII `error_description` values. ## Scope **In:** the `genericOAuth` and `socialProviders` config shape, covering all request stages; the provider-callback error surface; profile/claim mapping hooks on link and update. **Out:** issuer-side OAuth (see `tracking: oauth-provider conformance`). SSO plugin (see `tracking: SSO plugin`). OAuth state cookie writes (see OAuth state_mismatch cluster). ## Resolution criteria - One config type covers `authorize`, `token`, `refresh`, `userinfo`, `link` with parallel shape. - `clientSecret` and any stage URL/params accept a function of `(context, request)`. - Every provider-callback error surfaces a structured error payload without crashing on non-ASCII. - `mapProfileToUser` updates on every link and sign-in, not only on first create. - Provider-specific shapes (Cognito, Entra personal, Twitch refresh, etc.) are handled by the core contract, not inline overrides. ## Related - An RFC issue (or PR) defining the target config type closes most of the list in a single pass. - Type `related`: no single fix closes everything, but the RFC should name which existing issues become obsolete.
GiteaMirror added the trackingenhancementoauth labels 2026-04-17 20:03:15 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels enhancement oauth tracking
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28621