github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Oauth Provider - Follow RFC 8707 Resource Implementation #2962

New Issue
Open
opened 2026-03-13 10:30:46 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 10:30:46 -05:00
Owner
Copy Link

Originally created by @dvanmali on GitHub (Mar 2, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Configure OAuth provider with resource indicators enabled (RFC 8707 implementation).

Initiate /authorize request with:

GET /authorize?response_type=code
  &client_id=client
  &resource=https://api.example.com

Exchange authorization code at /token but:

Omit resource, or

Provide a different resource value (e.g., different order in array, or additional resource).

Observe token response.

OR (refresh flow):

Obtain refresh token issued with:

{
  "resources": ["https://api.example.com"]
}

Call /token with grant_type=refresh_token and:

Request a new resource not present in the refresh token, or

Change the order of the resources array.

Current vs. Expected behavior

Current behavior:

JWT Access Tokens can change resource parameters later after authorize.

Expected behavior:

The strict enforcement is correct per RFC 8707.

What version of Better Auth are you using?

=1.4

Originally created by @dvanmali on GitHub (Mar 2, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Configure OAuth provider with resource indicators enabled (RFC 8707 implementation). Initiate `/authorize` request with: ```http GET /authorize?response_type=code &client_id=client &resource=https://api.example.com ``` Exchange authorization code at /token but: Omit resource, or Provide a different resource value (e.g., different order in array, or additional resource). Observe token response. OR (refresh flow): Obtain refresh token issued with: ```json { "resources": ["https://api.example.com"] } ``` Call `/token` with `grant_type=refresh_token` and: Request a new resource not present in the refresh token, or Change the order of the resources array. ### Current vs. Expected behavior **Current behavior:** JWT Access Tokens can change resource parameters later after authorize. **Expected behavior:** The strict enforcement is correct per RFC 8707. ### What version of Better Auth are you using? >=1.4
GiteaMirror added the enhancement label 2026-03-13 10:30:46 -05:00
GiteaMirror commented 2026-03-13 10:30:48 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 2, 2026):

Your security concern is valid and confirmed. The current OAuth 2.1 provider implementation has gaps in RFC 8707 resource indicator enforcement:

Root Cause:

This allows clients to request different resources at /token than what was authorized, and refresh tokens can be used to obtain access tokens for any configured resource.

Fix in Progress:
PR #7855 addresses this by:

  • Storing resources with authorization codes and refresh tokens
  • Requiring exact resource match between /authorize and /token
  • Restricting refresh flows to originally-authorized resources
  • Returning invalid_target on validation failures

This PR is currently open and not yet merged. You may want to track it for updates.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Mar 2, 2026): <!-- Answer --> Your security concern is valid and confirmed. The current OAuth 2.1 provider implementation has gaps in RFC 8707 resource indicator enforcement: **Root Cause:** - The [`resource` parameter is not stored with authorization codes](https://github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/authorize.ts#L414-L426) during `/authorize` - [Refresh tokens don't persist resource/audience information](https://github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/schema.ts#L139-L196) - [`checkResource()` only validates against server-level `validAudiences`](https://github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/token.ts#L323-L361), not against what was originally authorized This allows clients to request different resources at `/token` than what was authorized, and refresh tokens can be used to obtain access tokens for any configured resource. **Fix in Progress:** [PR #7855](https://github.com/better-auth/better-auth/pull/7855) addresses this by: - Storing resources with authorization codes and refresh tokens - Requiring exact resource match between `/authorize` and `/token` - Restricting refresh flows to originally-authorized resources - Returning `invalid_target` on validation failures This PR is currently open and not yet merged. You may want to track it for updates. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/12f18dbe-19ee-4d53-a842-0621ce0788d1?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Your%20security%20concern%20is%20valid%20and%20confirmed.%20The%20current%20OAuth%202.1%20provider%20implementation%20has%20gaps%20in%20RFC%208707%20resource%20indicator%20enforcement%3A%0A%0A%2A%2ARoot%20Cause%3A%2A%2A%0A-%20The%20%5B%60resource%60%20parameter%20is%20not%20stored%20with%20authorization%20codes%5D%28https%3A//github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/authorize.ts%23L414-L426%29%20during%20%60/authorize%60%0A-%20%5BRefresh%20tokens%20don%27t%20persist%20resource/audience%20information%5D%28https%3A//github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/schema.ts%23L139-L196%29%0A-%20%5B%60checkResource%28%29%60%20only%20validates%20against%20server-level%20%60validAudiences%60%5D%28https%3A//github.com/better-auth/better-auth/blob/cb6939df748448cb5b2d48c5a929cb5b31692710/packages/oauth-provider/src/token.ts%23L323-L361%29%2C%20not%20against%20what%20was%20originally%20authorized%0A%0AThis%20allows%20clients%20to%20request%20different%20resources%20at%20%60/token%60%20than%20what%20was%20authorized%2C%20and%20refresh%20tokens%20can%20be%20used%20to%20obtain%20access%20tokens%20for%20any%20configured%20resource.%0A%0A%2A%2AFix%20in%20Progress%3A%2A%2A%0A%5BPR%20%237855%5D%28https%3A//github.com/better-auth/better-auth/pull/7855%29%20addresses%20this%20by%3A%0A-%20Storing%20resources%20with%20authorization%20codes%20and%20refresh%20tokens%0A-%20Requiring%20exact%20resource%20match%20between%20%60/authorize%60%20and%20%60/token%60%0A-%20Restricting%20refresh%20flows%20to%20originally-authorized%20resources%0A-%20Returning%20%60invalid_target%60%20on%20validation%20failures%0A%0AThis%20PR%20is%20currently%20open%20and%20not%20yet%20merged.%20You%20may%20want%20to%20track%20it%20for%20updates.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8298)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2962
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?