better-auth

mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 11:24:57 -05:00

Files

T

History

Bereket Engida bbeccec036 fix(one-tap): bind ID tokens to a server-issued single-use nonce

The One Tap client forwarded a caller-supplied nonce to Google, but the
callback never passed it to verifyGoogleIdToken, so the nonce claim was
never checked and a captured ID token could be replayed until it expired.

Add POST /one-tap/nonce, which stores a random single-use nonce in the
verification table. The client now fetches it before initializing Google
and sends it back with the ID token. The callback consumes the nonce
before verification, passes it to verifyGoogleIdToken, and rejects a
token that carries a nonce claim when none is presented.

Closes #10926

2026-09-03 22:27:30 -07:00

api-key

fix: align OpenAPI required fields with Zod 4.5 (#11066 )

2026-08-30 18:51:24 +00:00

better-auth

fix(one-tap): bind ID tokens to a server-issued single-use nonce

2026-09-03 22:27:30 -07:00

cimd

fix(cimd): answer the socket's all-addresses lookup in the Node transport (#10730 )

2026-09-03 20:25:17 +00:00

cli

fix(cli): skip empty dependency installs (#11140 )