mirror of
https://github.com/better-auth/better-auth.git
synced 2026-07-26 22:42:35 -05:00
482 B
482 B
@better-auth/oauth-provider, @better-auth/core, better-auth
| @better-auth/oauth-provider | @better-auth/core | better-auth |
|---|---|---|
| patch | patch | patch |
Harden redirect-URI validation across the OAuth provider plugins. isSafeUrlScheme and SafeUrlSchema no longer call URL.canParse, which is absent on some supported runtimes and could throw or silently disable the dangerous-scheme check. They now parse with a try/catch fallback. SafeUrlSchema also rejects redirect URIs that contain a fragment component, per RFC 6749 §3.1.2.