github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 23:53:17 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity
Files
docs-sync/next
better-auth/packages/electron/CHANGELOG.md
T

45 KiB
Raw Permalink Blame History

@better-auth/electron

1.7.10

1.7.9

1.7.8

Patch Changes

  • #11512 4175b34 Thanks @bytaesu! - Align the installed @better-auth/utils version with better-call while accepting ^0.4.2 || ^0.5.0 across official package peers.

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

Minor Changes

  • #9645 e014029 Thanks @ping-maxwell! - Harden the Electron OAuth flow and tighten custom-scheme trusted-origin matching.

    The Electron sign-in flow now mandates PKCE S256. Plain PKCE is rejected: the code_challenge_method parameter is gone and every authorization code is verified by hashing the verifier with SHA-256. The server no longer trusts an electron-origin header to set the request Origin. The Electron client now sends a real Origin (for example myapp:/), so upgrade the @better-auth/electron client and server together and make sure your app's scheme is in trustedOrigins. The unused disableOriginOverride option is removed.

    Custom-scheme entries in trustedOrigins now match by scheme and authority instead of string prefix. A host-less entry such as myapp:// or exp:// still trusts every host of that scheme, but a host-bearing entry such as myapp://callback matches that host exactly, so it is no longer satisfied by myapp://callback.attacker.tld.

  • #9069 c7d2253 Thanks @gustavovalverde! - Rewrite the generic OAuth plugin as a first-class social provider with OAuth 2.1 security defaults. Providers now use signIn.social + callback/:id instead of dedicated plugin endpoints, with PKCE required by default (OAuth 2.1), RFC 9207 issuer validation, OIDC auto-discovery with openid scope injection, and typed provider IDs.

    Breaking changes:

    • signIn.oauth2({ providerId }) replaced by signIn.social({ provider })
    • oauth2.link() replaced by linkSocial()
    • Callback URL changed from /api/auth/oauth2/callback/:id to /api/auth/callback/:id
    • genericOAuthClient() removed; generic OAuth providers now use the standard social client APIs
    • pkce defaults to true (was false); set pkce: false for providers that reject PKCE
    • authorizationUrlParams and tokenUrlParams only accept Record<string, string>
    • issuer and requireIssuerValidation config fields removed; issuer validation is automatic via OIDC discovery
    • mapProfileToUser profile typed as OAuth2UserInfo & Record<string, unknown>

Patch Changes

  • #10505 d701f90 Thanks @gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.

1.7.0-rc.6

Patch Changes

  • #10794 2ad2928 Thanks @bytaesu! - Restore client plugin declaration compatibility for downstream TypeScript consumers.

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Patch Changes

  • #10505 d701f90 Thanks @gustavovalverde! - One Tap, Electron, and Expo client plugins now compose with createAuthClient without TypeScript errors, and the resulting client preserves each plugin's inferred actions.

1.7.0-rc.2

1.7.0-rc.1

1.7.0-rc.0

1.7.0-beta.10

1.7.0-beta.9

Patch Changes

  • Updated dependencies []:
    • better-auth@1.7.0-beta.9
    • @better-auth/core@1.7.0-beta.9

1.7.0-beta.8

Patch Changes

1.7.0-beta.7

Patch Changes

  • Updated dependencies [3d04fab, de8394d]:
    • better-auth@1.7.0-beta.7
    • @better-auth/core@1.7.0-beta.7

1.7.0-beta.6

Patch Changes

1.7.0-beta.5

Minor Changes

  • #9645 e014029 Thanks @ping-maxwell! - Harden the Electron OAuth flow and tighten custom-scheme trusted-origin matching.

    The Electron sign-in flow now mandates PKCE S256. Plain PKCE is rejected: the code_challenge_method parameter is gone and every authorization code is verified by hashing the verifier with SHA-256. The server no longer trusts an electron-origin header to set the request Origin. The Electron client now sends a real Origin (for example myapp:/), so upgrade the @better-auth/electron client and server together and make sure your app's scheme is in trustedOrigins. The unused disableOriginOverride option is removed.

    Custom-scheme entries in trustedOrigins now match by scheme and authority instead of string prefix. A host-less entry such as myapp:// or exp:// still trusts every host of that scheme, but a host-bearing entry such as myapp://callback matches that host exactly, so it is no longer satisfied by myapp://callback.attacker.tld.

Patch Changes

1.7.0-beta.4

1.6.30

Patch Changes

  • Updated dependencies [07c1718]:
    • @better-auth/core@1.6.30
    • better-auth@1.6.30

1.6.29

Patch Changes

  • Updated dependencies [e6e1b4e]:
    • better-auth@1.6.29
    • @better-auth/core@1.6.29

1.6.28

Patch Changes

  • #10794 2ad2928 Thanks @bytaesu! - Restore client plugin declaration compatibility for downstream TypeScript consumers.

  • Updated dependencies [773de54, 2ad2928]:

    • better-auth@1.6.28
    • @better-auth/core@1.6.28

1.6.27

Patch Changes

  • Updated dependencies [2ae491e, 90b5093]:
    • @better-auth/core@1.6.27
    • better-auth@1.6.27

1.6.26

Patch Changes

1.6.25

Patch Changes

1.6.24

Patch Changes

1.6.23

Patch Changes

  • Updated dependencies [8581f97]:
    • better-auth@1.6.23
    • @better-auth/core@1.6.23

1.6.22

Patch Changes

1.6.21

Patch Changes

1.6.20

Patch Changes

1.6.19

Patch Changes

1.6.18

Patch Changes

  • Updated dependencies [9ef7240, b21a5f7]:
    • better-auth@1.6.18
    • @better-auth/core@1.6.18

1.6.17

Patch Changes

1.6.16

Patch Changes

  • #9974 cb1cbfa Thanks @Bekacru! - Require S256 PKCE for Electron auth transfers. The transfer flow previously defaulted a missing code_challenge_method to plain and the token exchange fell back to a plain string comparison for any non-s256 method. In plain mode the verifier equals the challenge, which already appears in the sign-in URL query, so the comparison did not add a meaningful check. Missing, unknown, and plain methods are now rejected at minting (handleTransfer, /electron/transfer-user, /electron/init-oauth-proxy) and at exchange (/electron/token). The official Electron client already uses S256, so existing flows are unaffected.

  • Updated dependencies [cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, cb1cbfa, 87e7aa5, cb1cbfa, cb1cbfa, cb1cbfa, 893cf6c, cb1cbfa, cb1cbfa, 5e49c56, cb1cbfa]:

    • better-auth@1.6.16
    • @better-auth/core@1.6.16

1.6.15

Patch Changes

1.6.14

Patch Changes

1.6.13

Patch Changes

1.7.0-beta.3

Patch Changes

  • Updated dependencies [4e8e4c7, 523f95c, 729c00d]:
    • better-auth@1.7.0-beta.3
    • @better-auth/core@1.7.0-beta.3

1.7.0-beta.2

Patch Changes

1.7.0-beta.1

Minor Changes

  • #9069 c7d2253 Thanks @gustavovalverde! - Rewrite the generic OAuth plugin as a first-class social provider with OAuth 2.1 security defaults. Providers now use signIn.social + callback/:id instead of dedicated plugin endpoints, with PKCE required by default (OAuth 2.1), RFC 9207 issuer validation, OIDC auto-discovery with openid scope injection, and typed provider IDs.

    Breaking changes:

    • signIn.oauth2({ providerId }) replaced by signIn.social({ provider })
    • oauth2.link() replaced by linkSocial()
    • Callback URL changed from /api/auth/oauth2/callback/:id to /api/auth/callback/:id
    • genericOAuthClient() removed; generic OAuth providers now use the standard social client APIs
    • pkce defaults to true (was false); set pkce: false for providers that reject PKCE
    • authorizationUrlParams and tokenUrlParams only accept Record<string, string>
    • issuer and requireIssuerValidation config fields removed; issuer validation is automatic via OIDC discovery
    • mapProfileToUser profile typed as OAuth2UserInfo & Record<string, unknown>

Patch Changes

1.7.0-beta.0

Patch Changes

1.6.10

Patch Changes

1.6.9

Patch Changes

  • Updated dependencies [815ecf6]:
    • @better-auth/core@1.6.9
    • better-auth@1.6.9

1.6.8

Patch Changes

  • Updated dependencies [856ab24, 9aa8e63]:
    • better-auth@1.6.8
    • @better-auth/core@1.6.8

1.6.7

Patch Changes

1.6.6

Patch Changes

  • #9226 e64ff72 Thanks @gustavovalverde! - Consolidate host/IP classification behind @better-auth/core/utils/host and close several loopback/SSRF bypasses that the previous per-package regex checks missed.

    Electron user-image proxy: SSRF bypasses closed (@better-auth/electron). fetchUserImage previously gated outbound requests with a bespoke IPv4/IPv6 regex that missed multiple vectors. All of the following were reachable in production and are now blocked:

    • http://tenant.localhost/ and other *.localhost names (RFC 6761 reserves the entire TLD for loopback).
    • http://[::ffff:169.254.169.254]/ (IPv4-mapped IPv6 to AWS IMDS, the classic SSRF bypass).
    • http://metadata.google.internal/, http://metadata.goog/ (GCP instance metadata).
    • http://instance-data/, http://instance-data.ec2.internal/ (AWS IMDS alternate FQDNs).
    • http://100.100.100.200/ (Alibaba Cloud IMDS; lives in RFC 6598 shared address space 100.64/10, which the old regex did not cover).
    • http://0.0.0.0:PORT/ (the Linux/macOS kernel routes the unspecified address to loopback: Oligo's "0.0.0.0 Day").
    • http://[fc00::...]/, http://[fd00::...]/ (IPv6 ULA per RFC 4193) and IPv6 link-local fe80::/10, neither of which the regex recognized.

    Documentation ranges (RFC 5737 / RFC 3849), benchmarking (198.18/15), multicast, and broadcast are also now rejected.

    better-auth: 0.0.0.0 is no longer treated as loopback. The previous isLoopbackHost implementation in packages/better-auth/src/utils/url.ts classified 0.0.0.0 alongside 127.0.0.1 / ::1 / localhost. 0.0.0.0 is the unspecified address, not loopback; treating it as such lets browser-origin requests reach localhost-bound dev services (Oligo's "0.0.0.0 Day"). The helper now accepts the full 127.0.0.0/8 range and any *.localhost name, and rejects 0.0.0.0.

    better-auth: trusted-origin substring hardening. getTrustedOrigins previously used host.includes("localhost") || host.includes("127.0.0.1") when deciding whether to add an http:// variant for a dynamic baseURL.allowedHosts entry. Misconfigurations like evil-localhost.com or 127.0.0.1.nip.io would incorrectly gain an HTTP origin in the trust list. The check now uses the shared classifier, so only real loopback hosts get the HTTP variant.

    @better-auth/oauth-provider: RFC 8252 compliance.

    • §7.3 redirect URI matching now accepts the full 127.0.0.0/8 range (not just 127.0.0.1) plus [::1], with port-flexible comparison. Port-flexible matching is limited to IP literals; DNS names such as localhost continue to use exact-string matching per §8.3 ("NOT RECOMMENDED" for loopback).
    • validateIssuerUrl uses the shared loopback check rather than a two-hostname literal comparison.

    New module: @better-auth/core/utils/host. Exposes classifyHost, isLoopbackIP, isLoopbackHost, and isPublicRoutableHost. One RFC 6890 / RFC 6761 / RFC 8252 implementation that handles IPv4, IPv6 (including bracketed literals, zone IDs, IPv4-mapped addresses, and 6to4 / NAT64 / Teredo tunnel forms with embedded-IPv4 recursion), and FQDNs, with a curated cloud-metadata FQDN set. All bespoke loopback/private/link-local checks across the monorepo now route through it.

  • Updated dependencies [b5742f9, 4debfb6, 9ea7eb1, a844c7d, ab4c10f, a61083e, e64ff72]:

    • @better-auth/core@1.6.6
    • better-auth@1.6.6

1.6.5

Patch Changes

  • Updated dependencies [938dd80, 0538627]:
    • better-auth@1.6.5
    • @better-auth/core@1.6.5

1.6.4

Patch Changes

1.6.3

Patch Changes

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

Patch Changes

1.6.0-beta.0

Minor Changes

  • 28b1291 Thanks @gustavovalverde! - Add optional version field to the plugin interface and expose version from all built-in plugins

Patch Changes

Reference in New Issue View Git Blame Copy Permalink