github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3601] [MERGED] fix(jwt): ensure alg is added to the jwks when generating via /token endpoint #4907

New Issue
Closed
opened 2026-03-13 12:03:48 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:03:48 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3601
Author: @elliottminns
Created: 7/24/2025
Status: ✅ Merged
Merged: 7/25/2025
Merged by: @Bekacru

Base: main ← Head: main

📝 Commits (2)

  • e593924 fix: Ensure alg is added to the jwks when generating via /token endpoint
  • 199ff25 chore: resolve linting issues

📊 Changes

2 files changed (+4 additions, -1 deletions)

View changed files

📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+1 -0)
📝 packages/better-auth/src/plugins/jwt/sign.ts (+3 -1)

📄 Description

When using the jwt plugin I noticed there was an issue with the public key missing the alg field whenever the JWKS was created via the /token endpoint compared to when it was created using the /jwks endpoint

For example:

/api/auth/token

apply=# SELECT public_key from jwks;
                                   public_key
---------------------------------------------------------------------------------
 {"crv":"Ed25519","x":"fi_qr9jILwhtL71fSwZad3RMrdbZqHCpd6NgCATXPEA","kty":"OKP"}
(1 row)

/api/auth/jwks

apply=# SELECT public_key from jwks;
                                          public_key
-----------------------------------------------------------------------------------------------
 {"alg":"EdDSA","crv":"Ed25519","x":"Apvgc4vNpmXtpUfjAxGlcqMeBW1FPVWGlcTNR8PQGZE","kty":"OKP"}
(1 row)

As you can see the alg field is created in the second example.

This PR resolves the issue, causing both endpoints to have the same outcome in the public_key structure.

For reference, below is how the /jwks endpoint adds the algo which is what I've mimicked in the fix.

68f09f15d3/packages/better-auth/src/plugins/jwt/index.ts (L258-L271)

Summary by cubic

Fixed an issue where the public key generated by the /token endpoint was missing the alg field, so both /token and /jwks now include alg in the public key.

  • Bug Fixes
  • Added alg to the public key structure in /token endpoint responses.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3601 **Author:** [@elliottminns](https://github.com/elliottminns) **Created:** 7/24/2025 **Status:** ✅ Merged **Merged:** 7/25/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`e593924`](https://github.com/better-auth/better-auth/commit/e593924a79967f3e6f16b4da14e9dfe2856c76e8) fix: Ensure alg is added to the jwks when generating via /token endpoint - [`199ff25`](https://github.com/better-auth/better-auth/commit/199ff2572ed7ebf0d316762a655158b5f725c0e1) chore: resolve linting issues ### 📊 Changes **2 files changed** (+4 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+1 -0) 📝 `packages/better-auth/src/plugins/jwt/sign.ts` (+3 -1) </details> ### 📄 Description When using the jwt plugin I noticed there was an issue with the public key missing the alg field whenever the JWKS was created via the `/token` endpoint compared to when it was created using the `/jwks` endpoint For example: `/api/auth/token` ``` apply=# SELECT public_key from jwks; public_key --------------------------------------------------------------------------------- {"crv":"Ed25519","x":"fi_qr9jILwhtL71fSwZad3RMrdbZqHCpd6NgCATXPEA","kty":"OKP"} (1 row) ``` `/api/auth/jwks` ``` apply=# SELECT public_key from jwks; public_key ----------------------------------------------------------------------------------------------- {"alg":"EdDSA","crv":"Ed25519","x":"Apvgc4vNpmXtpUfjAxGlcqMeBW1FPVWGlcTNR8PQGZE","kty":"OKP"} (1 row) ``` As you can see the `alg` field is created in the second example. This PR resolves the issue, causing both endpoints to have the same outcome in the public_key structure. For reference, below is how the `/jwks` endpoint adds the algo which is what I've mimicked in the fix. https://github.com/better-auth/better-auth/blob/68f09f15d3ef3339ece01f39c9a51bebd8f97010/packages/better-auth/src/plugins/jwt/index.ts#L258-L271 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixed an issue where the public key generated by the /token endpoint was missing the alg field, so both /token and /jwks now include alg in the public key. - **Bug Fixes** - Added alg to the public key structure in /token endpoint responses. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:03:48 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#4907
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?