mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-19 11:24:57 -05:00
Bereket Engida
cb8db5e67f
The discovery URL, and every endpoint taken from the discovery document, had to be a trusted origin, while assertEndpointResolvesPublic skips trusted origins. The DNS guard on the discovery path could therefore never fire, and multi-tenant deployments were pushed to allowlist the very issuers their tenants control. Align the discovery path with the manual-config path: publicly routable hosts are allowed without a trustedOrigins entry, so the resolution guard runs before the fetch. Non-public hosts still need trustedOrigins and now fail with discovery_private_host. discovery_untrusted_origin stays in the error code union, deprecated, but is no longer emitted. Fixes #10830 Fixes #10831