Gustavo Valverdeandthaoms
2c29c1e919
Multi-host deployments configured with `baseURL: { allowedHosts: [...] }`
now produce absolute `redirect_uri` values for generic-OAuth providers. Auth0
and other strict authorization servers previously rejected the authorize step
because `genericOAuth` captured `ctx.baseURL` at init time, which is the empty
sentinel under dynamic config.
Every `OAuthProvider` now declares `callbackPath: string`. Endpoints compose
`redirectURI = ctx.context.baseURL + provider.callbackPath` in the
social-sign-in, callback, link-account, and oauth-proxy handlers, removing the
init-time `ctx.baseURL` read across the OAuth surface. Built-in providers use
`/callback/<id>`; generic-OAuth uses `/oauth2/callback/<id>`.
The interface change is invisible to app developers. Third-party plugin
authors who construct their own `OAuthProvider` must add `callbackPath` to
their factory.
Resolves #9593. Partial fix for #4151.
Co-Authored-By: thaoms <2323270+thaoms@users.noreply.github.com>
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please send an e-mail to security@better-auth.com.
All reports will be promptly addressed, and you'll be credited accordingly.