github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8009] [MERGED] feat(auth): support dynamic baseURL with allowedHosts #7685

New Issue
Closed
opened 2026-03-13 13:45:36 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:45:36 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8009
Author: @Paola3stefania
Created: 2/16/2026
Status: ✅ Merged
Merged: 2/20/2026
Merged by: @himself65

Base: canary ← Head: feat/dynamic-baseurl-allowlist

📝 Commits (10+)

  • 5aa20bf poc: dynamic baseurl
  • 2f8e503 Merge branch 'canary' into feat/dynamic-baseurl-allowlist
  • dcd2017 Merge branch 'canary' into feat/dynamic-baseurl-allowlist
  • 9a461b8 race condition and type fixes
  • 3a113cb new test and race comment
  • c0b7300 dynamic cookie
  • 6b6aa0e make lint happy
  • cce3655 update docu
  • a548f63 Merge branch 'canary' into feat/dynamic-baseurl-allowlist
  • 853c330 fix origin and base path

📊 Changes

20 files changed (+1405 additions, -60 deletions)

View changed files

➕ docs/content/docs/concepts/dynamic-base-url.mdx (+258 -0)
📝 packages/better-auth/src/auth/base.ts (+75 -16)
📝 packages/better-auth/src/auth/full.test.ts (+293 -0)
📝 packages/better-auth/src/auth/trusted-origins.ts (+43 -0)
📝 packages/better-auth/src/context/create-context.ts (+26 -4)
📝 packages/better-auth/src/context/helpers.ts (+32 -5)
📝 packages/better-auth/src/cookies/index.ts (+35 -8)
📝 packages/better-auth/src/integrations/svelte-kit.ts (+3 -1)
📝 packages/better-auth/src/plugins/jwt/sign.ts (+8 -2)
📝 packages/better-auth/src/plugins/jwt/verify.ts (+6 -2)
📝 packages/better-auth/src/plugins/mcp/index.ts (+18 -3)
📝 packages/better-auth/src/plugins/oauth-proxy/index.ts (+8 -2)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+3 -1)
📝 packages/better-auth/src/test-utils/test-instance.ts (+14 -5)
📝 packages/better-auth/src/utils/url.test.ts (+328 -1)
📝 packages/better-auth/src/utils/url.ts (+161 -0)
📝 packages/core/src/types/index.ts (+2 -0)
📝 packages/core/src/types/init-options.ts (+66 -4)
📝 packages/passkey/src/routes.ts (+20 -4)
📝 packages/telemetry/src/index.ts (+6 -2)

📄 Description

Addresses https://github.com/better-auth/better-auth/issues/4151

Summary by cubic

Adds dynamic baseURL resolution with an allowlist to support multi-domain and preview deployments. Resolves the base URL per request, isolates request context, updates JWT/cookies/trusted origins, and adds docs. Addresses better-auth/better-auth#4151.

  • New Features

    • baseURL now accepts { allowedHosts, fallback?, protocol? } with wildcard support (e.g., .vercel.app, preview-.myapp.com, localhost:*); validated to be non-empty.
    • Per-request host/protocol resolution via x-forwarded-host/proto with strict validation; unknown hosts are rejected unless a fallback is set. trustedOrigins auto-expands with all allowedHosts and the fallback (adds http for localhost).
    • Request-scoped context prevents cross-host races; JWT issuer/audience and MCP/OAuth Proxy/OIDC/Passkey/Telemetry now use the resolved origin.
    • Cookies: with crossSubDomainCookies enabled, the cookie domain is derived per request; Secure flag precedence is advanced.useSecureCookies > dynamic protocol (https/http) > static baseURL scheme > NODE_ENV for auto/unset.

  • Bug Fixes

    • Corrected origin and basePath handling across URL builders (OAuth Proxy error URL, MCP, OIDC, SvelteKit), ensuring consistent behavior for static and dynamic configs.
    • Minor typing and lint cleanups.

Written for commit 5d1848dd50. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8009 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 2/16/2026 **Status:** ✅ Merged **Merged:** 2/20/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/dynamic-baseurl-allowlist` --- ### 📝 Commits (10+) - [`5aa20bf`](https://github.com/better-auth/better-auth/commit/5aa20bf50ab2182d2649847d66d0410eb74ba190) poc: dynamic baseurl - [`2f8e503`](https://github.com/better-auth/better-auth/commit/2f8e503acdc6715d5a00f2f02606d7de01160dcb) Merge branch 'canary' into feat/dynamic-baseurl-allowlist - [`dcd2017`](https://github.com/better-auth/better-auth/commit/dcd20177a4fd7a6c78a7344253cbee42f55940e9) Merge branch 'canary' into feat/dynamic-baseurl-allowlist - [`9a461b8`](https://github.com/better-auth/better-auth/commit/9a461b8cd82ed228bab918a8780e02181f6f2678) race condition and type fixes - [`3a113cb`](https://github.com/better-auth/better-auth/commit/3a113cbcf42a258432a741c79eb5d3e669ce721a) new test and race comment - [`c0b7300`](https://github.com/better-auth/better-auth/commit/c0b73007bebfc050d4d8c746d73580394db5a54c) dynamic cookie - [`6b6aa0e`](https://github.com/better-auth/better-auth/commit/6b6aa0ed07dd472ce611320d869c6b4c76c35144) make lint happy - [`cce3655`](https://github.com/better-auth/better-auth/commit/cce36552dd182e9ebbabfd9a06ccab0010caf1c1) update docu - [`a548f63`](https://github.com/better-auth/better-auth/commit/a548f638e517ce07b2b507bf750cb4cd3307aa96) Merge branch 'canary' into feat/dynamic-baseurl-allowlist - [`853c330`](https://github.com/better-auth/better-auth/commit/853c33011b021f15ad69d9e364d12bc583b6b1e9) fix origin and base path ### 📊 Changes **20 files changed** (+1405 additions, -60 deletions) <details> <summary>View changed files</summary> ➕ `docs/content/docs/concepts/dynamic-base-url.mdx` (+258 -0) 📝 `packages/better-auth/src/auth/base.ts` (+75 -16) 📝 `packages/better-auth/src/auth/full.test.ts` (+293 -0) 📝 `packages/better-auth/src/auth/trusted-origins.ts` (+43 -0) 📝 `packages/better-auth/src/context/create-context.ts` (+26 -4) 📝 `packages/better-auth/src/context/helpers.ts` (+32 -5) 📝 `packages/better-auth/src/cookies/index.ts` (+35 -8) 📝 `packages/better-auth/src/integrations/svelte-kit.ts` (+3 -1) 📝 `packages/better-auth/src/plugins/jwt/sign.ts` (+8 -2) 📝 `packages/better-auth/src/plugins/jwt/verify.ts` (+6 -2) 📝 `packages/better-auth/src/plugins/mcp/index.ts` (+18 -3) 📝 `packages/better-auth/src/plugins/oauth-proxy/index.ts` (+8 -2) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+3 -1) 📝 `packages/better-auth/src/test-utils/test-instance.ts` (+14 -5) 📝 `packages/better-auth/src/utils/url.test.ts` (+328 -1) 📝 `packages/better-auth/src/utils/url.ts` (+161 -0) 📝 `packages/core/src/types/index.ts` (+2 -0) 📝 `packages/core/src/types/init-options.ts` (+66 -4) 📝 `packages/passkey/src/routes.ts` (+20 -4) 📝 `packages/telemetry/src/index.ts` (+6 -2) </details> ### 📄 Description Addresses https://github.com/better-auth/better-auth/issues/4151 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds dynamic baseURL resolution with an allowlist to support multi-domain and preview deployments. Resolves the base URL per request, isolates request context, updates JWT/cookies/trusted origins, and adds docs. Addresses better-auth/better-auth#4151. - **New Features** - baseURL now accepts { allowedHosts, fallback?, protocol? } with wildcard support (e.g., *.vercel.app, preview-*.myapp.com, localhost:*); validated to be non-empty. - Per-request host/protocol resolution via x-forwarded-host/proto with strict validation; unknown hosts are rejected unless a fallback is set. trustedOrigins auto-expands with all allowedHosts and the fallback (adds http for localhost). - Request-scoped context prevents cross-host races; JWT issuer/audience and MCP/OAuth Proxy/OIDC/Passkey/Telemetry now use the resolved origin. - Cookies: with crossSubDomainCookies enabled, the cookie domain is derived per request; Secure flag precedence is advanced.useSecureCookies > dynamic protocol (https/http) > static baseURL scheme > NODE_ENV for auto/unset. - **Bug Fixes** - Corrected origin and basePath handling across URL builders (OAuth Proxy error URL, MCP, OIDC, SvelteKit), ensuring consistent behavior for static and dynamic configs. - Minor typing and lint cleanups. <sup>Written for commit 5d1848dd50c1cccd3319618ba5479c79b659ff16. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:45:36 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7685
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?