github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7855] fix(oauth-provider): resource indicators rfc 8707 #7593

New Issue
Open
opened 2026-03-13 13:42:33 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:42:33 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7855
Author: @dvanmali
Created: 2/8/2026
Status: 🔄 Open

Base: canary ← Head: opResourceIndicators

📝 Commits (3)

  • d0ea2da fix: follow resource indicators rfc8707
  • 106f35c fix: check resource after pkce
  • d5b1b30 fix: ai suggestions

📊 Changes

8 files changed (+171 additions, -19 deletions)

View changed files

📝 docs/content/docs/plugins/oauth-provider.mdx (+7 -2)
📝 packages/oauth-provider/src/authorize.ts (+31 -0)
📝 packages/oauth-provider/src/consent.ts (+3 -0)
📝 packages/oauth-provider/src/introspect.ts (+2 -1)
📝 packages/oauth-provider/src/oauth.ts (+15 -7)
📝 packages/oauth-provider/src/schema.ts (+12 -0)
📝 packages/oauth-provider/src/token.ts (+83 -7)
📝 packages/oauth-provider/src/types/index.ts (+18 -2)

📄 Description

Follows the resource indicator spec RFC 8707.

Improvements:

  • Prevents resource value changes between /authorize and /token
  • Restricts refresh and access tokens to resources specified at issuance
  • customAccessTokenClaims properly uses the resources field to indicate the resource at both /token and /introspect. (deprecates resource field).
  • resource supported across all grant types: authorization_code, client_credentials, refresh_token

Closes: #8298

Summary by cubic

Implements RFC 8707 resource indicators across the OAuth provider. Tokens are scoped to requested resources with strict checks at authorize, token, and refresh; resource validation runs after PKCE and returns invalid_target on failure.

  • New Features

    • Accepts resource on /authorize and /token as a string or array; validates after PKCE (errors use invalid_target). Consent stores resources and prompts again if new ones are requested.
    • Authorization code exchange requires the exact same resource set as the original /authorize request; refresh grants restrict requested resources to those on the refresh token.
    • Access and refresh tokens store resources; customAccessTokenClaims and introspection receive/expose resources; requesting resource yields a JWT access token (opaque tokens also persist resources). Supported on authorization_code, client_credentials, and refresh_token grants.

  • Migration

    • Replace customAccessTokenClaims.resource with customAccessTokenClaims.resources.
    • Keep the resource set consistent from /authorize to /token; refresh requests must only include resources allowed by the refresh token.

Written for commit d5b1b30145fde25bbd1a7a6f1eee50540378ebdb. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7855 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 2/8/2026 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `opResourceIndicators` --- ### 📝 Commits (3) - [`d0ea2da`](https://github.com/better-auth/better-auth/commit/d0ea2dad0e66bfacfcd4f4333763a0705dc6789d) fix: follow resource indicators rfc8707 - [`106f35c`](https://github.com/better-auth/better-auth/commit/106f35c74acadb15e17f01f365a0d3fede4607e0) fix: check resource after pkce - [`d5b1b30`](https://github.com/better-auth/better-auth/commit/d5b1b30145fde25bbd1a7a6f1eee50540378ebdb) fix: ai suggestions ### 📊 Changes **8 files changed** (+171 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/oauth-provider.mdx` (+7 -2) 📝 `packages/oauth-provider/src/authorize.ts` (+31 -0) 📝 `packages/oauth-provider/src/consent.ts` (+3 -0) 📝 `packages/oauth-provider/src/introspect.ts` (+2 -1) 📝 `packages/oauth-provider/src/oauth.ts` (+15 -7) 📝 `packages/oauth-provider/src/schema.ts` (+12 -0) 📝 `packages/oauth-provider/src/token.ts` (+83 -7) 📝 `packages/oauth-provider/src/types/index.ts` (+18 -2) </details> ### 📄 Description Follows the resource indicator spec [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html). **Improvements**: - Prevents `resource` value changes between `/authorize` and `/token` - Restricts refresh and access tokens to `resources` specified at issuance - `customAccessTokenClaims` properly uses the `resources` field to indicate the resource at both `/token` and `/introspect`. (deprecates `resource` field). - `resource` supported across all grant types: authorization_code, client_credentials, refresh_token Closes: #8298 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Implements RFC 8707 resource indicators across the OAuth provider. Tokens are scoped to requested resources with strict checks at authorize, token, and refresh; resource validation runs after PKCE and returns invalid_target on failure. - **New Features** - Accepts resource on /authorize and /token as a string or array; validates after PKCE (errors use invalid_target). Consent stores resources and prompts again if new ones are requested. - Authorization code exchange requires the exact same resource set as the original /authorize request; refresh grants restrict requested resources to those on the refresh token. - Access and refresh tokens store resources; customAccessTokenClaims and introspection receive/expose resources; requesting resource yields a JWT access token (opaque tokens also persist resources). Supported on authorization_code, client_credentials, and refresh_token grants. - **Migration** - Replace customAccessTokenClaims.resource with customAccessTokenClaims.resources. - Keep the resource set consistent from /authorize to /token; refresh requests must only include resources allowed by the refresh token. <sup>Written for commit d5b1b30145fde25bbd1a7a6f1eee50540378ebdb. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:42:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7593
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?