github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7568] [MERGED] feat(sso): add SP-initiated SAML Single Logout (SLO) #7407

New Issue
Closed
opened 2026-03-13 13:35:16 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:35:16 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7568
Author: @Paola3stefania
Created: 1/23/2026
Status: ✅ Merged
Merged: 2/13/2026
Merged by: @himself65

Base: feat/saml-single-logout ← Head: feat/saml-slo-sp-initiated

📝 Commits (10+)

  • 0a08ab5 feat: initiate SLO
  • 2da7191 feat: handlelogout
  • eeffbe9 feat: SP metadata includes SingleLogoutService
  • 4f22a2b tests
  • 6f03fe2 merge: integrate parent branch changes
  • 512fb60 Merge branch 'feat/saml-single-logout' into feat/saml-slo-sp-initiated
  • 24a336b better security and lookup
  • a01020e cleanup and validation
  • 967e1b7 cleanup and verification
  • 02bc214 types

📊 Changes

93 files changed (+2642 additions, -3877 deletions)

View changed files

📝 .github/workflows/ci.yml (+6 -11)
📝 .github/workflows/e2e.yml (+6 -16)
📝 .github/workflows/preview.yml (+6 -4)
📝 .github/workflows/release.yml (+7 -0)
📝 docs/app/docs/[[...slug]]/page.tsx (+6 -1)
📝 docs/app/global.css (+3 -2)
➕ docs/components/back-link.tsx (+21 -0)
📝 docs/components/community-plugins-table.tsx (+10 -0)
📝 docs/components/docs/page.tsx (+1 -1)
📝 docs/components/side-bar.tsx (+6 -1)
📝 docs/components/sidebar-content.tsx (+8 -0)
📝 docs/components/ui/aside-link.tsx (+5 -2)
📝 docs/content/blogs/1-4.mdx (+1 -1)
📝 docs/content/docs/concepts/plugins.mdx (+1 -1)
➖ docs/content/docs/errors/index.mdx (+0 -21)
📝 docs/content/docs/guides/your-first-plugin.mdx (+1 -1)
📝 docs/content/docs/integrations/convex.mdx (+468 -331)
📝 docs/content/docs/plugins/i18n.mdx (+1 -1)
📝 docs/content/docs/plugins/one-tap.mdx (+68 -0)
📝 docs/content/docs/plugins/stripe.mdx (+1 -1)

...and 73 more files

📄 Description

Our SP                              IdP
 │                                   │
 │  1. LogoutRequest ──────────────► │
 │                                   │ 2. IdP logs out user
 │  ◄────────────── 3. LogoutResponse│
 │  4. Process response              │

Summary by cubic

Adds SAML Single Logout (SLO) for SP-initiated and IdP-initiated flows with stronger validation, signing controls, and cleaner session teardown across the app and IdP.

  • New Features

    • Endpoints:
      • POST /sso/saml2/logout/:providerId to initiate SLO (redirects to IdP).
      • GET/POST /sso/saml2/sp/slo/:providerId to handle IdP-initiated LogoutRequest and the LogoutResponse for SP-initiated flows.
    • SP metadata exposes SingleLogoutService (POST and Redirect) when Single Logout is enabled.
    • Config: optional signing checks for logout messages (wantLogoutRequestSigned, wantLogoutResponseSigned) and a configurable LogoutRequest TTL.
    • Session tracking: stores NameID + SessionIndex on login, adds reverse lookup by Better Auth session ID, records LogoutRequest IDs with TTL, and clears them on LogoutResponse.
    • Security/validation: supports Redirect and POST bindings, validates SessionIndex/NameID, secures RelayState parsing, and returns a safe HTML POST form. Emits specific SAML SLO error codes on failures.

  • Migration

    • Enable via saml.enableSingleLogout: true (optional saml.logoutRequestTTL and signing flags).
    • Ensure IdP metadata includes SingleLogoutService; SP metadata will include it when enabled.
    • From the app, call POST /sso/saml2/logout/:providerId with optional { callbackURL }.

Written for commit 38e0530741. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7568 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 1/23/2026 **Status:** ✅ Merged **Merged:** 2/13/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `feat/saml-single-logout` ← **Head:** `feat/saml-slo-sp-initiated` --- ### 📝 Commits (10+) - [`0a08ab5`](https://github.com/better-auth/better-auth/commit/0a08ab5e98aec592e18d6a08c60f293a13ed0f4c) feat: initiate SLO - [`2da7191`](https://github.com/better-auth/better-auth/commit/2da719116c3b1fd52eb54782286e64dc86969fbc) feat: handlelogout - [`eeffbe9`](https://github.com/better-auth/better-auth/commit/eeffbe9d3d3d03b089f6f1d9ac4c9a0ca755b766) feat: SP metadata includes SingleLogoutService - [`4f22a2b`](https://github.com/better-auth/better-auth/commit/4f22a2b92752577dcc6591bc25e784b3c03b0398) tests - [`6f03fe2`](https://github.com/better-auth/better-auth/commit/6f03fe24ae9995d55f81c28385ff016124017e9f) merge: integrate parent branch changes - [`512fb60`](https://github.com/better-auth/better-auth/commit/512fb60be15aea9000965616bc46064d9483c599) Merge branch 'feat/saml-single-logout' into feat/saml-slo-sp-initiated - [`24a336b`](https://github.com/better-auth/better-auth/commit/24a336b35e7242738b5964b03a65caa8053e2b33) better security and lookup - [`a01020e`](https://github.com/better-auth/better-auth/commit/a01020e5778e90bfdc55b20e79a884e1a5eb87eb) cleanup and validation - [`967e1b7`](https://github.com/better-auth/better-auth/commit/967e1b7b28e1c5ccb3682f8def65b7e022057740) cleanup and verification - [`02bc214`](https://github.com/better-auth/better-auth/commit/02bc21423ca093015f68dcbeb0d234791d7c569e) types ### 📊 Changes **93 files changed** (+2642 additions, -3877 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+6 -11) 📝 `.github/workflows/e2e.yml` (+6 -16) 📝 `.github/workflows/preview.yml` (+6 -4) 📝 `.github/workflows/release.yml` (+7 -0) 📝 `docs/app/docs/[[...slug]]/page.tsx` (+6 -1) 📝 `docs/app/global.css` (+3 -2) ➕ `docs/components/back-link.tsx` (+21 -0) 📝 `docs/components/community-plugins-table.tsx` (+10 -0) 📝 `docs/components/docs/page.tsx` (+1 -1) 📝 `docs/components/side-bar.tsx` (+6 -1) 📝 `docs/components/sidebar-content.tsx` (+8 -0) 📝 `docs/components/ui/aside-link.tsx` (+5 -2) 📝 `docs/content/blogs/1-4.mdx` (+1 -1) 📝 `docs/content/docs/concepts/plugins.mdx` (+1 -1) ➖ `docs/content/docs/errors/index.mdx` (+0 -21) 📝 `docs/content/docs/guides/your-first-plugin.mdx` (+1 -1) 📝 `docs/content/docs/integrations/convex.mdx` (+468 -331) 📝 `docs/content/docs/plugins/i18n.mdx` (+1 -1) 📝 `docs/content/docs/plugins/one-tap.mdx` (+68 -0) 📝 `docs/content/docs/plugins/stripe.mdx` (+1 -1) _...and 73 more files_ </details> ### 📄 Description ``` Our SP IdP │ │ │ 1. LogoutRequest ──────────────► │ │ │ 2. IdP logs out user │ ◄────────────── 3. LogoutResponse│ │ 4. Process response │ ``` <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds SAML Single Logout (SLO) for SP-initiated and IdP-initiated flows with stronger validation, signing controls, and cleaner session teardown across the app and IdP. - **New Features** - Endpoints: - POST /sso/saml2/logout/:providerId to initiate SLO (redirects to IdP). - GET/POST /sso/saml2/sp/slo/:providerId to handle IdP-initiated LogoutRequest and the LogoutResponse for SP-initiated flows. - SP metadata exposes SingleLogoutService (POST and Redirect) when Single Logout is enabled. - Config: optional signing checks for logout messages (wantLogoutRequestSigned, wantLogoutResponseSigned) and a configurable LogoutRequest TTL. - Session tracking: stores NameID + SessionIndex on login, adds reverse lookup by Better Auth session ID, records LogoutRequest IDs with TTL, and clears them on LogoutResponse. - Security/validation: supports Redirect and POST bindings, validates SessionIndex/NameID, secures RelayState parsing, and returns a safe HTML POST form. Emits specific SAML SLO error codes on failures. - **Migration** - Enable via saml.enableSingleLogout: true (optional saml.logoutRequestTTL and signing flags). - Ensure IdP metadata includes SingleLogoutService; SP metadata will include it when enabled. - From the app, call POST /sso/saml2/logout/:providerId with optional { callbackURL }. <sup>Written for commit 38e05307417aa3d3751cef507aac655fd706cd33. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:35:16 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7407
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?