mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-20 20:26:55 -05:00
Gustavo Valverdeandthaoms
2c29c1e919
Multi-host deployments configured with `baseURL: { allowedHosts: [...] }`
now produce absolute `redirect_uri` values for generic-OAuth providers. Auth0
and other strict authorization servers previously rejected the authorize step
because `genericOAuth` captured `ctx.baseURL` at init time, which is the empty
sentinel under dynamic config.
Every `OAuthProvider` now declares `callbackPath: string`. Endpoints compose
`redirectURI = ctx.context.baseURL + provider.callbackPath` in the
social-sign-in, callback, link-account, and oauth-proxy handlers, removing the
init-time `ctx.baseURL` read across the OAuth surface. Built-in providers use
`/callback/<id>`; generic-OAuth uses `/oauth2/callback/<id>`.
The interface change is invisible to app developers. Third-party plugin
authors who construct their own `OAuthProvider` must add `callbackPath` to
their factory.
Resolves #9593. Partial fix for #4151.
Co-Authored-By: thaoms <2323270+thaoms@users.noreply.github.com>
Changesets
Hello and welcome! This folder has been automatically generated by @changesets/cli, a build tool that works
with multi-package repos, or single-package repos to help you version and publish your code. You can
find the full documentation for it in our repository.
We have a quick list of common questions to get you started engaging with this project in our documentation.