github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3845] [MERGED] feat(oidc): pass oauth consent code via query params #5046

New Issue
Closed
opened 2026-03-13 12:09:05 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:09:05 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3845
Author: @grant0417
Created: 8/7/2025
Status: ✅ Merged
Merged: 8/7/2025
Merged by: @Bekacru

Base: canary ← Head: canary

📝 Commits (4)

📊 Changes

5 files changed (+94 additions, -20 deletions)

View changed files

📝 docs/content/docs/plugins/oidc-provider.mdx (+26 -3)
📝 packages/better-auth/src/plugins/oidc-provider/authorize.ts (+8 -3)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+52 -8)
📝 packages/better-auth/src/plugins/oidc-provider/oidc.test.ts (+3 -1)
📝 packages/better-auth/src/plugins/oidc-provider/types.ts (+5 -5)

📄 Description

This PR adds support for passing consent codes via URL parameters in addition to the existing cookie-based approach.

What changed

The /oauth2/consent endpoint now accepts the consent code in two ways:

// New: URL parameter method
const res = await client.oauth2.consent({
  accept: true,
  consent_code: consentCode // from URL params
});

// Existing: Cookie-based method  
const res = await client.oauth2.consent({
  accept: true
  // consent_code read from cookie
});

When redirecting to the consent page, we now include consent_code in the URL:

/consent?consent_code=abc123&client_id=...&scope=...

Why?

The cookie-based approach doesn't work well in environments with third-party cookie restrictions (iframe).

Breaking changes

None - existing implementations continue to work as before.

Summary by cubic

Added support for passing the OAuth consent code via URL parameters, in addition to the existing cookie-based method. This improves compatibility with environments that block third-party cookies, such as iframes.

  • New Features
    • The /oauth2/consent endpoint now accepts the consent code from either a URL parameter or a cookie.
    • Consent page redirects now include the consent_code in the URL.
    • Documentation updated to show both consent code methods.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3845 **Author:** [@grant0417](https://github.com/grant0417) **Created:** 8/7/2025 **Status:** ✅ Merged **Merged:** 8/7/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `canary` --- ### 📝 Commits (4) - [`8fb12c0`](https://github.com/better-auth/better-auth/commit/8fb12c0b0926e3aad3f5882a78ea61380a676115) feat: pass oauth consent code via query params - [`afa2c29`](https://github.com/better-auth/better-auth/commit/afa2c29afce15fdc8c46908455164ff4f71047d6) address cubic comments - [`77489af`](https://github.com/better-auth/better-auth/commit/77489afd33a89351e51536d3b49f0996540b9cd2) fix tests - [`035af0a`](https://github.com/better-auth/better-auth/commit/035af0ac4b92caa8a23916d6f106d69466cfec49) address comments ### 📊 Changes **5 files changed** (+94 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/oidc-provider.mdx` (+26 -3) 📝 `packages/better-auth/src/plugins/oidc-provider/authorize.ts` (+8 -3) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+52 -8) 📝 `packages/better-auth/src/plugins/oidc-provider/oidc.test.ts` (+3 -1) 📝 `packages/better-auth/src/plugins/oidc-provider/types.ts` (+5 -5) </details> ### 📄 Description This PR adds support for passing consent codes via URL parameters in addition to the existing cookie-based approach. ## What changed The `/oauth2/consent` endpoint now accepts the consent code in two ways: ```typescript // New: URL parameter method const res = await client.oauth2.consent({ accept: true, consent_code: consentCode // from URL params }); // Existing: Cookie-based method const res = await client.oauth2.consent({ accept: true // consent_code read from cookie }); ``` When redirecting to the consent page, we now include `consent_code` in the URL: ``` /consent?consent_code=abc123&client_id=...&scope=... ``` ## Why? The cookie-based approach doesn't work well in environments with third-party cookie restrictions (iframe). ## Breaking changes None - existing implementations continue to work as before. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Added support for passing the OAuth consent code via URL parameters, in addition to the existing cookie-based method. This improves compatibility with environments that block third-party cookies, such as iframes. - **New Features** - The `/oauth2/consent` endpoint now accepts the consent code from either a URL parameter or a cookie. - Consent page redirects now include the `consent_code` in the URL. - Documentation updated to show both consent code methods. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:09:05 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5046
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?