Gustavo Valverde
92d4e229ce
OAuth providers without an issuer shared the `local:` namespace with credential and SIWE identities, so a provider ID could resolve to an internal method's identity and inherit its user. An identity match skips every implicit-linking gate, which made that namespace the only thing standing between an aliased provider and another method's account. Token and account-info routes resolved their provider configuration from the public `providerId` alias, so an SSO provider registered under a social provider's alias could redeem its stored tokens against that provider's client credentials. Provider instances already namespace identity and account keys, so resolve configuration from them too. TikTok is typed as always returning `union_id`, but the field is not guaranteed. Reject that authentication instead of deriving a subject from a missing value. Correct the SSO domain rule, which rejects a provider unless every entry resolves; the joins section, which documented an `experimental` option that does not exist; and the Okta example, which enabled IdP-initiated SAML that the plugin disables by default.
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please send an e-mail to security@better-auth.com.
All reports will be promptly addressed, and you'll be credited accordingly.