github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6784] [MERGED] feat(saml): reject deprecated SAML signature and digest algorithms #6879

New Issue
Closed
opened 2026-03-13 13:15:06 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:15:06 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6784
Author: @Paola3stefania
Created: 12/15/2025
Status: ✅ Merged
Merged: 12/23/2025
Merged by: @himself65

Base: canary ← Head: feat/saml-algorithm-allowlist

📝 Commits (8)

  • 1647e00 feat: validate config
  • 6c87cfd feat in sso
  • 81a8e0a feat : test
  • 62e0fda fix: tests
  • dc0d7bd make lint happy
  • 9584cd4 Merge branch 'canary' into feat/saml-algorithm-allowlist
  • 7c388cd Merge branch 'canary' into feat/saml-algorithm-allowlist
  • 33e7bcb feat(saml): normalize algorithm names before validation (#6804)

📊 Changes

5 files changed (+381 additions, -1 deletions)

View changed files

📝 docs/content/docs/plugins/sso.mdx (+15 -0)
📝 packages/sso/src/routes/sso.ts (+11 -1)
📝 packages/sso/src/saml/algorithms.test.ts (+244 -0)
📝 packages/sso/src/saml/algorithms.ts (+109 -0)
📝 packages/sso/src/saml/index.ts (+2 -0)

📄 Description

THis PRs relays on https://github.com/better-auth/better-auth/pull/6785

Summary by cubic

Adds SAML algorithm validation that warns by default and lets apps reject or allow deprecated algorithms (SHA-1, RSA 1.5, 3DES). Validation runs on provider config and incoming SAML responses, with allow-lists and utilities to read encryption algorithms and detect EncryptedAssertion.

  • New Features
    • Validates signature, digest (config), key encryption, and data encryption algorithms; default is "warn". Runs at provider registration and during ACS/callback.
    • New config: sso.saml.algorithms.onDeprecated = "reject" | "warn" | "allow", plus custom allow-lists for signature and digest.
    • Added validateConfigAlgorithms to check provider config, normalize short-form names (e.g., rsa-sha256, sha256), and return clear API errors for deprecated, unknown, or disallowed values.
    • Docs list supported/deprecated algorithms; unit tests added.

Written for commit 33e7bcb9ad. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6784 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/15/2025 **Status:** ✅ Merged **Merged:** 12/23/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/saml-algorithm-allowlist` --- ### 📝 Commits (8) - [`1647e00`](https://github.com/better-auth/better-auth/commit/1647e00c50c2db09c53f4dd1d2d42272f2698583) feat: validate config - [`6c87cfd`](https://github.com/better-auth/better-auth/commit/6c87cfd9f4aa58542b2c4ff71f8c24968aea16da) feat in sso - [`81a8e0a`](https://github.com/better-auth/better-auth/commit/81a8e0a45b7e0342791c2e9a5f572e6e987164a8) feat : test - [`62e0fda`](https://github.com/better-auth/better-auth/commit/62e0fda581c0e53c83e3f71107010e457472f5fa) fix: tests - [`dc0d7bd`](https://github.com/better-auth/better-auth/commit/dc0d7bde0e0458f5499139f1880a15a4197d00ba) make lint happy - [`9584cd4`](https://github.com/better-auth/better-auth/commit/9584cd4760e45c8c92106e6af011d50ac8f3076c) Merge branch 'canary' into feat/saml-algorithm-allowlist - [`7c388cd`](https://github.com/better-auth/better-auth/commit/7c388cdb3602188847139b9adaad9bc8e013afc2) Merge branch 'canary' into feat/saml-algorithm-allowlist - [`33e7bcb`](https://github.com/better-auth/better-auth/commit/33e7bcb9ad4b3918c081fd6b955315319f29a6e5) feat(saml): normalize algorithm names before validation (#6804) ### 📊 Changes **5 files changed** (+381 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/sso.mdx` (+15 -0) 📝 `packages/sso/src/routes/sso.ts` (+11 -1) 📝 `packages/sso/src/saml/algorithms.test.ts` (+244 -0) 📝 `packages/sso/src/saml/algorithms.ts` (+109 -0) 📝 `packages/sso/src/saml/index.ts` (+2 -0) </details> ### 📄 Description THis PRs relays on https://github.com/better-auth/better-auth/pull/6785 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds SAML algorithm validation that warns by default and lets apps reject or allow deprecated algorithms (SHA-1, RSA 1.5, 3DES). Validation runs on provider config and incoming SAML responses, with allow-lists and utilities to read encryption algorithms and detect EncryptedAssertion. - **New Features** - Validates signature, digest (config), key encryption, and data encryption algorithms; default is "warn". Runs at provider registration and during ACS/callback. - New config: sso.saml.algorithms.onDeprecated = "reject" | "warn" | "allow", plus custom allow-lists for signature and digest. - Added validateConfigAlgorithms to check provider config, normalize short-form names (e.g., rsa-sha256, sha256), and return clear API errors for deprecated, unknown, or disallowed values. - Docs list supported/deprecated algorithms; unit tests added. <sup>Written for commit 33e7bcb9ad4b3918c081fd6b955315319f29a6e5. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:15:06 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6879
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?