github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6170] [CLOSED] fix(oidc-provider): improve error handling #6496

New Issue
Closed
opened 2026-03-13 13:01:13 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:01:13 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6170
Author: @himself65
Created: 11/21/2025
Status: ❌ Closed

Base: canary ← Head: himself65/2025/11/21/token

📝 Commits (6)

  • a3d9f9d fix(oidc-provider): improve error handling for client authentication and token validation
  • 49adad5 fix(index): remove unnecessary Content-Type header from request
  • c71011d lint fix
  • 32f278b chore: fix error page
  • 97e5a6c feat: add error
  • cf13fce fix: doc

📊 Changes

2 files changed (+192 additions, -90 deletions)

View changed files

📝 packages/better-auth/src/plugins/oidc-provider/error.ts (+66 -0)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+126 -90)

📄 Description

…and token validation

Summary by cubic

Aligns OIDC token endpoint errors with OAuth/OIDC specs and adds confidential client authentication. Improves security, reduces information leakage, and makes responses predictable.

  • Bug Fixes

    • Normalize error types per spec: invalid_request, invalid_client (401 + WWW-Authenticate when Basic is used), invalid_grant, unsupported_grant_type.
    • Require client_id for token requests.
    • Enforce confidential client auth: verify client_secret for non-public clients.
    • Map code/redirect/PKCE/refresh/user issues to invalid_grant with clearer messages.
    • Set no-store/no-cache headers on token responses; include Content-Type for JSON.

  • Migration

    • Confidential clients must include a valid client_secret in token requests; public clients are unchanged.

Written for commit cf13fceb5b. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6170 **Author:** [@himself65](https://github.com/himself65) **Created:** 11/21/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `himself65/2025/11/21/token` --- ### 📝 Commits (6) - [`a3d9f9d`](https://github.com/better-auth/better-auth/commit/a3d9f9dd76a93ce720032661d60e69ab5fc1f09a) fix(oidc-provider): improve error handling for client authentication and token validation - [`49adad5`](https://github.com/better-auth/better-auth/commit/49adad58aee57089d0b74a3a0379cfaac5534385) fix(index): remove unnecessary Content-Type header from request - [`c71011d`](https://github.com/better-auth/better-auth/commit/c71011d7ac30dbff7d035e9ed02afcf8202a7c44) lint fix - [`32f278b`](https://github.com/better-auth/better-auth/commit/32f278b5949c04933886bed85fd1c8e54fc9f87a) chore: fix error page - [`97e5a6c`](https://github.com/better-auth/better-auth/commit/97e5a6ca058af16bcd710175d03f429e94ae257c) feat: add error - [`cf13fce`](https://github.com/better-auth/better-auth/commit/cf13fceb5b27add872a992126c1e9f406c4f68df) fix: doc ### 📊 Changes **2 files changed** (+192 additions, -90 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/oidc-provider/error.ts` (+66 -0) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+126 -90) </details> ### 📄 Description …and token validation <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Aligns OIDC token endpoint errors with OAuth/OIDC specs and adds confidential client authentication. Improves security, reduces information leakage, and makes responses predictable. - **Bug Fixes** - Normalize error types per spec: invalid_request, invalid_client (401 + WWW-Authenticate when Basic is used), invalid_grant, unsupported_grant_type. - Require client_id for token requests. - Enforce confidential client auth: verify client_secret for non-public clients. - Map code/redirect/PKCE/refresh/user issues to invalid_grant with clearer messages. - Set no-store/no-cache headers on token responses; include Content-Type for JSON. - **Migration** - Confidential clients must include a valid client_secret in token requests; public clients are unchanged. <sup>Written for commit cf13fceb5b27add872a992126c1e9f406c4f68df. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:01:13 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6496
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?