github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7855] fix(oauth-provider): resource indicators rfc 8707 #33194

New Issue
Open
opened 2026-04-17 23:51:16 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 23:51:16 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7855
Author: @dvanmali
Created: 2/8/2026
Status: 🔄 Open

Base: next ← Head: opResourceIndicators

📝 Commits (1)

  • 415f411 fix: follow resource indicators rfc8707

📊 Changes

11 files changed (+256 additions, -28 deletions)

View changed files

➕ .changeset/free-files-tease.md (+15 -0)
📝 docs/content/docs/plugins/oauth-provider.mdx (+7 -2)
📝 packages/oauth-provider/src/authorize.ts (+43 -0)
📝 packages/oauth-provider/src/consent.ts (+3 -0)
📝 packages/oauth-provider/src/introspect.ts (+2 -1)
📝 packages/oauth-provider/src/oauth.ts (+26 -8)
📝 packages/oauth-provider/src/schema.ts (+12 -0)
📝 packages/oauth-provider/src/token.test.ts (+46 -0)
📝 packages/oauth-provider/src/token.ts (+75 -15)
📝 packages/oauth-provider/src/types/index.ts (+18 -2)
📝 packages/oauth-provider/src/types/zod.ts (+9 -0)

📄 Description

Follows the resource indicator spec RFC 8707.

Improvements:

  • Prevents resource value changes between /authorize and /token
  • Restricts refresh and access tokens to resources specified at issuance
  • customAccessTokenClaims properly uses the resources field to indicate the resource at both /token and /introspect. (deprecates resource field).
  • resource supported across all grant types: authorization_code, client_credentials, refresh_token

Deprecations:

  • customAccessTokenClaims properly uses the resources field to indicate the resource at both /token and /introspect (resource field in this function is deprecated).

Closes: #8298

Summary by cubic

Implements RFC 8707 resource indicators in @better-auth/oauth-provider. Resources are validated at /authorize, tokens are bound to authorized resources at /token and on refresh, and invalid or unauthorized resources return invalid_target.

  • New Features

    • Accepts resource on /authorize and /token as a string, array, or repeated parameter; validated as safe URLs without fragments. Consent stores resources and re-prompts if new ones are requested (prompt=none returns consent_required).
    • /token falls back to resources authorized at /authorize when omitted; if provided, they must be a subset. Refresh requests may only include resources on the refresh token; refresh tokens retain their original resources.
    • Access, refresh, and opaque access tokens persist resources; customAccessTokenClaims now receives resources at issuance and introspection. Using resource yields a JWT access token (opaque tokens also store resources). Supported on authorization_code, client_credentials, and refresh_token.

  • Migration

    • Replace customAccessTokenClaims.resource with customAccessTokenClaims.resources.
    • Remove resource from /introspect requests; use resources via customAccessTokenClaims for audience-based claims.

Written for commit 415f411d9b. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7855 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 2/8/2026 **Status:** 🔄 Open **Base:** `next` ← **Head:** `opResourceIndicators` --- ### 📝 Commits (1) - [`415f411`](https://github.com/better-auth/better-auth/commit/415f411d9b16db9514349952aeb50794648999a4) fix: follow resource indicators rfc8707 ### 📊 Changes **11 files changed** (+256 additions, -28 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/free-files-tease.md` (+15 -0) 📝 `docs/content/docs/plugins/oauth-provider.mdx` (+7 -2) 📝 `packages/oauth-provider/src/authorize.ts` (+43 -0) 📝 `packages/oauth-provider/src/consent.ts` (+3 -0) 📝 `packages/oauth-provider/src/introspect.ts` (+2 -1) 📝 `packages/oauth-provider/src/oauth.ts` (+26 -8) 📝 `packages/oauth-provider/src/schema.ts` (+12 -0) 📝 `packages/oauth-provider/src/token.test.ts` (+46 -0) 📝 `packages/oauth-provider/src/token.ts` (+75 -15) 📝 `packages/oauth-provider/src/types/index.ts` (+18 -2) 📝 `packages/oauth-provider/src/types/zod.ts` (+9 -0) </details> ### 📄 Description Follows the resource indicator spec [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html). **Improvements**: - Prevents `resource` value changes between `/authorize` and `/token` - Restricts refresh and access tokens to `resources` specified at issuance - `customAccessTokenClaims` properly uses the `resources` field to indicate the resource at both `/token` and `/introspect`. (deprecates `resource` field). - `resource` supported across all grant types: authorization_code, client_credentials, refresh_token **Deprecations**: - `customAccessTokenClaims` properly uses the `resources` field to indicate the resource at both `/token` and `/introspect` (`resource` field in this function is deprecated). Closes: #8298 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Implements RFC 8707 resource indicators in `@better-auth/oauth-provider`. Resources are validated at `/authorize`, tokens are bound to authorized resources at `/token` and on refresh, and invalid or unauthorized resources return `invalid_target`. - **New Features** - Accepts `resource` on `/authorize` and `/token` as a string, array, or repeated parameter; validated as safe URLs without fragments. Consent stores resources and re-prompts if new ones are requested (`prompt=none` returns `consent_required`). - `/token` falls back to resources authorized at `/authorize` when omitted; if provided, they must be a subset. Refresh requests may only include resources on the refresh token; refresh tokens retain their original resources. - Access, refresh, and opaque access tokens persist `resources`; `customAccessTokenClaims` now receives `resources` at issuance and introspection. Using `resource` yields a JWT access token (opaque tokens also store `resources`). Supported on `authorization_code`, `client_credentials`, and `refresh_token`. - **Migration** - Replace `customAccessTokenClaims.resource` with `customAccessTokenClaims.resources`. - Remove `resource` from `/introspect` requests; use `resources` via `customAccessTokenClaims` for audience-based claims. <sup>Written for commit 415f411d9b16db9514349952aeb50794648999a4. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 23:51:16 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#33194
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?