better_auth-sso 0.8.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7aeb07725d9147d0ea71a45cd26ce3d5a8ea62668a6f20a3b52a85faa75b2a0c
-  data.tar.gz: 33904ef6ca664b29892995aa1d8acc7d18e254a31f598a1c2890fb15e1410c8c
+  metadata.gz: 4a30af57534227b0842402e5c2b0f0e1dba463c9e162313b30a64bbbba4dbdc4
+  data.tar.gz: 49028a1009cb10b762a6518f3a451d8de7513234cf3f322943724ce9c78e1609
 SHA512:
-  metadata.gz: 60cee7f073bf639c84fc8f966524416666d8e42d71a9c62b0491b69c0825c77bf779721a38ffe4fe514aabf097c4b07f80e6c797821a0fe3d6aa42e60f3c9b01
-  data.tar.gz: 335191868b3b4d82a3dd77ea32ff3c38b37a0ff609036c402a3e1a5e2750712da8775f8f3193b105e65a2436422de94bf6708ec9ab5f049f0733124ea30d5639
+  metadata.gz: 2964e7ccda5662d364b0c87243b67e0d486f6bd7786692364c438eaa20feeb054c405d6a49daf70fde3649ce709279fd964f4ebc51a10ecf3c02c238d92b7c33
+  data.tar.gz: c72d4f2b51525461c1628c34dfbad25c0f56cf1a5d416eb30be317061d105be7db027d107e37993a596e7f30a393ab951101babd269ac86b5c526ff1a7c3a895

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 0.10.0 - 2026-05-21
+
+- Hardened SSO redirect, OIDC, SAML metadata, logout, and response handling.
+- Expanded adapter, Rack edge-case, and rate-limit coverage.
+
 ## 0.7.0 - 2026-05-05
 
 - Fixed SAML config validation for `singleSignOnService` and added validation for `singleLogoutService`.

data/lib/better_auth/sso/plugin/core.rb

@@ -66,6 +66,9 @@ module BetterAuth
     SSO_SAML_LOGOUT_REQUEST_KEY_PREFIX = "saml-logout-request:"
     SSO_SAML_STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success"
     SSO_DEFAULT_LOGOUT_REQUEST_TTL_MS = 5 * 60 * 1000
+    SSO_DEFAULT_OIDC_HTTP_TIMEOUT = 10
+    SSO_DEFAULT_OIDC_HTTP_MAX_BODY_SIZE = 1024 * 1024
+    SSO_OIDC_PKCE_VERIFIER_KEY_PREFIX = "oidc-pkce-verifier:"
 
     def sso(options = {})
       config = normalize_hash(options)
@@ -135,5 +138,185 @@ module BetterAuth
     def sso_schema(config = {})
       BetterAuth::SSO::Routes::Schemas.plugin_schema(config)
     end
+
+    def sso_openapi_for(route)
+      {
+        register_provider: sso_register_provider_openapi,
+        sign_in: sso_sign_in_openapi,
+        saml_callback: sso_saml_callback_openapi,
+        saml_acs: sso_saml_acs_openapi,
+        saml_slo: sso_saml_slo_openapi,
+        initiate_slo: sso_initiate_slo_openapi,
+        update_provider: sso_update_provider_openapi,
+        delete_provider: sso_delete_provider_openapi
+      }.fetch(route)
+    end
+
+    def sso_register_provider_openapi
+      {
+        openapi: {
+          description: "Register an SSO provider",
+          requestBody: OpenAPI.json_request_body(sso_provider_body_schema(required_fields: ["provider_id", "issuer", "domain"])),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider registered", sso_provider_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_sign_in_openapi
+      {
+        openapi: {
+          description: "Start an SSO sign-in flow",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                provider_id: {type: "string", description: "SSO provider ID"},
+                domain: {type: "string", description: "Email domain used to select a provider"},
+                provider_type: {type: "string", enum: ["oidc", "saml"], description: "Preferred provider protocol"},
+                callback_url: {type: "string", description: "URL to redirect to after successful sign-in"},
+                error_callback_url: {type: "string", description: "URL to redirect to on sign-in error"},
+                new_user_callback_url: {type: "string", description: "URL to redirect to for new users"},
+                request_sign_up: {type: "boolean", description: "Whether the flow is requesting sign-up"}
+              }
+            )
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SSO sign-in URL", OpenAPI.object_schema({url: {type: "string"}, redirect: {type: "boolean"}}, required: ["url", "redirect"]))
+          }
+        }
+      }
+    end
+
+    def sso_saml_callback_openapi
+      {
+        openapi: {
+          description: "Handle a SAML identity provider callback",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML callback handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_saml_acs_openapi
+      {
+        openapi: {
+          description: "Handle a SAML assertion consumer service response",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML response handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_saml_slo_openapi
+      {
+        openapi: {
+          description: "Handle SAML single logout",
+          requestBody: OpenAPI.json_request_body(sso_saml_message_schema, required: false),
+          responses: {
+            "200" => OpenAPI.json_response("SAML single logout handled", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_initiate_slo_openapi
+      {
+        openapi: {
+          description: "Initiate SAML single logout",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                callback_url: {type: "string", description: "URL to return to after logout"}
+              }
+            ),
+            required: false
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SAML logout initiated", {type: "object", additionalProperties: true})
+          }
+        }
+      }
+    end
+
+    def sso_update_provider_openapi
+      {
+        openapi: {
+          description: "Update an SSO provider",
+          requestBody: OpenAPI.json_request_body(sso_provider_body_schema(required_fields: [])),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider updated", sso_provider_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_delete_provider_openapi
+      {
+        openapi: {
+          description: "Delete an SSO provider",
+          requestBody: OpenAPI.json_request_body(
+            OpenAPI.object_schema(
+              {
+                provider_id: {type: "string", description: "SSO provider ID"}
+              }
+            )
+          ),
+          responses: {
+            "200" => OpenAPI.json_response("SSO provider deleted", OpenAPI.success_response_schema)
+          }
+        }
+      }
+    end
+
+    def sso_provider_body_schema(required_fields:)
+      OpenAPI.object_schema(
+        {
+          provider_id: {type: "string", description: "SSO provider ID"},
+          issuer: {type: "string", description: "SSO provider issuer URL"},
+          domain: {type: "string", description: "Email domain for the provider"},
+          oidc_config: {type: "object", additionalProperties: true, description: "OIDC provider configuration"},
+          saml_config: {type: "object", additionalProperties: true, description: "SAML provider configuration"},
+          organization_id: {type: "string", description: "Organization ID for this provider"},
+          override_user_info: {type: "boolean", description: "Whether to override OIDC user info with ID token claims"}
+        },
+        required: required_fields
+      )
+    end
+
+    def sso_provider_response_schema
+      OpenAPI.object_schema(
+        {
+          id: {type: "string"},
+          providerId: {type: "string"},
+          issuer: {type: "string"},
+          domain: {type: "string"},
+          oidcConfig: {type: ["object", "null"], additionalProperties: true},
+          samlConfig: {type: ["object", "null"], additionalProperties: true},
+          userId: {type: "string"},
+          organizationId: {type: ["string", "null"]},
+          domainVerified: {type: "boolean"},
+          redirectURI: {type: "string"},
+          domainVerificationToken: {type: "string"}
+        }
+      )
+    end
+
+    def sso_saml_message_schema
+      OpenAPI.object_schema(
+        {
+          SAMLResponse: {type: "string", description: "SAML response"},
+          SAMLRequest: {type: "string", description: "SAML logout request"},
+          RelayState: {type: "string", description: "SAML relay state"},
+          saml_response: {type: "string", description: "SAML response"},
+          saml_request: {type: "string", description: "SAML logout request"},
+          relay_state: {type: "string", description: "SAML relay state"}
+        }
+      )
+    end
   end
 end

data/lib/better_auth/sso/plugin/endpoints.rb

@@ -5,13 +5,13 @@ module BetterAuth
     module_function
 
     def sso_saml_callback_endpoint(config)
-      Endpoint.new(path: "/sso/saml2/callback/:providerId", method: ["GET", "POST"], metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+      Endpoint.new(path: "/sso/saml2/callback/:providerId", method: ["GET", "POST"], metadata: sso_openapi_for(:saml_callback).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
         sso_handle_saml_response(ctx, config)
       end
     end
 
     def sso_saml_acs_endpoint(config)
-      Endpoint.new(path: "/sso/saml2/sp/acs/:providerId", method: "POST", metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+      Endpoint.new(path: "/sso/saml2/sp/acs/:providerId", method: "POST", metadata: sso_openapi_for(:saml_acs).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
         sso_handle_saml_response(ctx, config)
       end
     end
@@ -30,7 +30,7 @@ module BetterAuth
     end
 
     def sso_saml_slo_endpoint(config = {})
-      Endpoint.new(path: "/sso/saml2/sp/slo/:providerId", method: ["GET", "POST"], metadata: {allowed_media_types: ["application/json", "application/x-www-form-urlencoded"]}) do |ctx|
+      Endpoint.new(path: "/sso/saml2/sp/slo/:providerId", method: ["GET", "POST"], metadata: sso_openapi_for(:saml_slo).merge(allowed_media_types: ["application/json", "application/x-www-form-urlencoded"])) do |ctx|
         raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
 
         provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
@@ -44,6 +44,8 @@ module BetterAuth
         end
 
         raw_request = sso_fetch(ctx.body, :saml_request) || sso_fetch(ctx.query, :saml_request)
+        raise APIError.new("BAD_REQUEST", message: "Invalid LogoutRequest") if raw_request.to_s.empty?
+
         sso_validate_saml_slo_signature!(ctx, raw_request, "Invalid LogoutRequest") if config.dig(:saml, :want_logout_request_signed)
         logout_request_data = sso_process_saml_logout_request(ctx, provider, raw_request)
         in_response_to = logout_request_data[:id].to_s.empty? ? "" : " InResponseTo=\"#{CGI.escapeHTML(logout_request_data[:id].to_s)}\""
@@ -59,7 +61,7 @@ module BetterAuth
     end
 
     def sso_initiate_slo_endpoint(config = {})
-      Endpoint.new(path: "/sso/saml2/logout/:providerId", method: "POST") do |ctx|
+      Endpoint.new(path: "/sso/saml2/logout/:providerId", method: "POST", metadata: sso_openapi_for(:initiate_slo)) do |ctx|
         raise APIError.new("BAD_REQUEST", message: "Single Logout is not enabled") unless config.dig(:saml, :enable_single_logout)
 
         session = Routes.current_session(ctx)

data/lib/better_auth/sso/plugin/oidc_discovery.rb

@@ -5,71 +5,32 @@ module BetterAuth
     module_function
 
     def sso_discover_oidc_config(issuer:, fetch: nil, existing_config: nil, discovery_endpoint: nil, trusted_origin: nil, timeout: nil)
-      existing = normalize_hash(existing_config || {})
-      discovery_url = discovery_endpoint || existing[:discovery_endpoint] || "#{issuer.to_s.sub(%r{/+\z}, "")}/.well-known/openid-configuration"
-      if trusted_origin && !trusted_origin.call(discovery_url)
-        raise APIError.new("BAD_REQUEST", message: "OIDC discovery endpoint is not trusted")
-      end
-      document = if fetch
-        fetch.call(discovery_url)
-      else
-        uri = URI(discovery_url)
-        JSON.parse(Net::HTTP.get(uri))
-      end
-      document = normalize_hash(document)
-      valid = document[:issuer].to_s.sub(%r{/+\z}, "") == issuer.to_s.sub(%r{/+\z}, "") &&
-        !document[:authorization_endpoint].to_s.empty? &&
-        !document[:token_endpoint].to_s.empty? &&
-        !document[:jwks_uri].to_s.empty?
-      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document") unless valid
+      wrapped_fetch = sso_oidc_discovery_fetcher(fetch)
+      BetterAuth::SSO::OIDC::Discovery.discover_oidc_config(
+        issuer: issuer,
+        fetch: wrapped_fetch,
+        existing_config: existing_config,
+        discovery_endpoint: discovery_endpoint,
+        trusted_origin: trusted_origin,
+        timeout: timeout || SSO_DEFAULT_OIDC_HTTP_TIMEOUT
+      )
+    rescue BetterAuth::SSO::OIDC::DiscoveryError => error
+      raise BetterAuth::SSO::OIDC::Errors.api_error(error)
+    end
 
-      authorization_endpoint = sso_normalize_discovery_url(document[:authorization_endpoint], issuer, trusted_origin)
-      token_endpoint = sso_normalize_discovery_url(document[:token_endpoint], issuer, trusted_origin)
-      jwks_endpoint = sso_normalize_discovery_url(document[:jwks_uri], issuer, trusted_origin)
-      user_info_endpoint = document[:userinfo_endpoint] && sso_normalize_discovery_url(document[:userinfo_endpoint], issuer, trusted_origin)
-      auth_methods = Array(document[:token_endpoint_auth_methods_supported])
-      token_endpoint_authentication = if existing[:token_endpoint_authentication]
-        existing[:token_endpoint_authentication]
-      elsif auth_methods.include?("client_secret_post") && !auth_methods.include?("client_secret_basic")
-        "client_secret_post"
-      else
-        "client_secret_basic"
-      end
+    def sso_oidc_discovery_fetcher(fetch)
+      return nil unless fetch
 
-      {
-        issuer: existing[:issuer] || document[:issuer],
-        discovery_endpoint: existing[:discovery_endpoint] || discovery_url,
-        client_id: existing[:client_id],
-        authorization_endpoint: existing[:authorization_endpoint] || authorization_endpoint,
-        token_endpoint: existing[:token_endpoint] || token_endpoint,
-        jwks_endpoint: existing[:jwks_endpoint] || jwks_endpoint,
-        user_info_endpoint: existing[:user_info_endpoint] || user_info_endpoint,
-        token_endpoint_authentication: token_endpoint_authentication,
-        scopes_supported: existing[:scopes_supported] || document[:scopes_supported]
-      }.compact
-    rescue APIError
-      raise
-    rescue
-      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document")
+      ->(url, timeout: nil) do
+        accepts_keywords = fetch.parameters.any? { |kind, name| kind == :keyrest || (kind == :key && name == :timeout) }
+        accepts_keywords ? fetch.call(url, timeout: timeout) : fetch.call(url)
+      end
     end
 
     def sso_normalize_discovery_url(value, issuer, trusted_origin)
-      uri = URI(value.to_s)
-      normalized = if uri.absolute?
-        uri.to_s
-      else
-        issuer_uri = URI(issuer.to_s)
-        issuer_base = issuer_uri.to_s.sub(%r{/+\z}, "")
-        endpoint = value.to_s.sub(%r{\A/+}, "")
-        "#{issuer_base}/#{endpoint}"
-      end
-      if trusted_origin && !trusted_origin.call(normalized)
-        raise APIError.new("BAD_REQUEST", message: "OIDC discovery endpoint is not trusted")
-      end
-
-      normalized
-    rescue URI::InvalidURIError
-      raise APIError.new("BAD_REQUEST", message: "Invalid OIDC discovery document")
+      BetterAuth::SSO::OIDC::Discovery.normalize_url("url", value, issuer, trusted_origin)
+    rescue BetterAuth::SSO::OIDC::DiscoveryError => error
+      raise BetterAuth::SSO::OIDC::Errors.api_error(error)
     end
   end
 end

data/lib/better_auth/sso/plugin/oidc_runtime.rb

@@ -11,7 +11,7 @@ module BetterAuth
     end
 
     def sso_oidc_authorization_url(provider, ctx, state, plugin_config = {}, body = {})
-      config = normalize_hash(provider["oidcConfig"] || {})
+      config = sso_provider_config_hash(provider["oidcConfig"])
       endpoint = config[:authorization_endpoint] || config[:authorization_url]
       raise APIError.new("BAD_REQUEST", message: "Invalid OIDC configuration. Authorization URL not found.") if endpoint.to_s.empty?
 
@@ -23,13 +23,14 @@ module BetterAuth
         scope: scopes.join(" "),
         state: state
       }.compact
-      nonce = sso_decode_state(state, ctx.context.secret)&.fetch("nonce", nil)
+      decoded_state = sso_decode_state(state, ctx.context.secret)
+      nonce = decoded_state&.fetch("nonce", nil)
       query[:nonce] = nonce if nonce && !nonce.to_s.empty?
       login_hint = body[:login_hint] || body[:email]
       query[:login_hint] = login_hint if login_hint
-      code_verifier = sso_decode_state(state, ctx.context.secret)&.fetch("codeVerifier", nil)
-      if code_verifier
-        query[:code_challenge] = sso_base64_urlsafe(OpenSSL::Digest::SHA256.digest(code_verifier))
+      code_challenge = decoded_state&.fetch("codeChallenge", nil)
+      if code_challenge
+        query[:code_challenge] = code_challenge
         query[:code_challenge_method] = "S256"
       end
       "#{endpoint}?#{URI.encode_www_form(query)}"
@@ -41,7 +42,7 @@ module BetterAuth
         return auth_request_url.call(provider: provider, relay_state: relay_state, context: ctx)
       end
 
-      config = normalize_hash(provider["samlConfig"] || {})
+      config = sso_provider_config_hash(provider["samlConfig"])
       metadata = sso_saml_idp_metadata(config)
       entry_point = config[:entry_point] || normalize_hash(sso_saml_preferred_service(metadata[:single_sign_on_service]) || {})[:location]
       query = {
@@ -101,7 +102,7 @@ module BetterAuth
           return sso_redirect(ctx, sso_append_error(state["callbackURL"] || "/", "invalid_saml_response", "Provider mismatch"))
         end
 
-        ctx.context.internal_adapter.delete_verification_by_identifier(identifier)
+        return {identifier: identifier}
       elsif config.dig(:saml, :allow_idp_initiated) == false
         return sso_redirect(ctx, sso_append_error(state["callbackURL"] || "/", "unsolicited_response", "IdP-initiated SSO not allowed"))
       end
@@ -109,6 +110,11 @@ module BetterAuth
       nil
     end
 
+    def sso_consume_saml_in_response_to(ctx, result)
+      identifier = result.is_a?(Hash) ? result[:identifier] : nil
+      ctx.context.internal_adapter.delete_verification_by_identifier(identifier) unless identifier.to_s.empty?
+    end
+
     def sso_parse_saml_authn_request_record(value)
       JSON.parse(value.to_s)
     rescue
@@ -170,12 +176,13 @@ module BetterAuth
       ctx.context.adapter.find_one(model: "ssoProvider", where: [{field: "providerId", value: provider_id.to_s}])
     end
 
-    def sso_oidc_tokens(ctx, provider, oidc_config, state, plugin_config)
+    def sso_oidc_tokens(ctx, provider, oidc_config, state, plugin_config, raw_state: nil)
+      code_verifier = sso_oidc_code_verifier(ctx, raw_state || state["state"] || state[:state])
       token_callback = oidc_config[:get_token]
       if token_callback.respond_to?(:call)
         return normalize_hash(token_callback.call(
           code: ctx.query[:code] || ctx.query["code"],
-          codeVerifier: state["codeVerifier"],
+          codeVerifier: code_verifier,
           redirectURI: sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId")),
           provider: provider,
           context: ctx
@@ -188,17 +195,19 @@ module BetterAuth
       sso_exchange_oidc_code(
         token_endpoint: token_endpoint,
         code: ctx.query[:code] || ctx.query["code"],
-        code_verifier: state["codeVerifier"],
+        code_verifier: code_verifier,
         redirect_uri: sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId")),
         client_id: oidc_config[:client_id],
         client_secret: oidc_config[:client_secret],
-        authentication: oidc_config[:token_endpoint_authentication]
+        authentication: oidc_config[:token_endpoint_authentication],
+        timeout: plugin_config[:oidc_http_timeout],
+        max_body_size: plugin_config[:oidc_http_max_body_size]
       )
     rescue
       nil
     end
 
-    def sso_exchange_oidc_code(token_endpoint:, code:, code_verifier:, redirect_uri:, client_id:, client_secret:, authentication:)
+    def sso_exchange_oidc_code(token_endpoint:, code:, code_verifier:, redirect_uri:, client_id:, client_secret:, authentication:, timeout: nil, max_body_size: nil)
       uri = URI(token_endpoint.to_s)
       request = Net::HTTP::Post.new(uri)
       form = {
@@ -214,8 +223,15 @@ module BetterAuth
         request.basic_auth(client_id.to_s, client_secret.to_s)
       end
       request.set_form_data(form)
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = Net::HTTP.start(
+        uri.hostname,
+        uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: sso_oidc_http_timeout(timeout),
+        read_timeout: sso_oidc_http_timeout(timeout)
+      ) { |http| http.request(request) }
       return nil unless response.is_a?(Net::HTTPSuccess)
+      return nil if response.body.to_s.bytesize > sso_oidc_http_max_body_size(max_body_size)
 
       normalize_hash(JSON.parse(response.body))
     end
@@ -225,7 +241,7 @@ module BetterAuth
       raw = if user_callback.respond_to?(:call)
         user_callback.call(tokens)
       elsif oidc_config[:user_info_endpoint]
-        sso_fetch_oidc_user_info(oidc_config[:user_info_endpoint], tokens[:access_token])
+        sso_fetch_oidc_user_info(oidc_config[:user_info_endpoint], tokens[:access_token], timeout: plugin_config[:oidc_http_timeout], max_body_size: plugin_config[:oidc_http_max_body_size])
       elsif tokens[:id_token]
         return {_sso_error: "jwks_endpoint_not_found"} if oidc_config[:jwks_endpoint].to_s.empty?
 
@@ -256,12 +272,19 @@ module BetterAuth
       )
     end
 
-    def sso_fetch_oidc_user_info(endpoint, access_token)
+    def sso_fetch_oidc_user_info(endpoint, access_token, timeout: nil, max_body_size: nil)
       uri = URI(endpoint.to_s)
       request = Net::HTTP::Get.new(uri)
       request["authorization"] = "Bearer #{access_token}"
-      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(request) }
+      response = Net::HTTP.start(
+        uri.hostname,
+        uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: sso_oidc_http_timeout(timeout),
+        read_timeout: sso_oidc_http_timeout(timeout)
+      ) { |http| http.request(request) }
       return {} unless response.is_a?(Net::HTTPSuccess)
+      return {} if response.body.to_s.bytesize > sso_oidc_http_max_body_size(max_body_size)
 
       JSON.parse(response.body)
     rescue
@@ -297,8 +320,15 @@ module BetterAuth
       end
 
       uri = URI(jwks_endpoint.to_s)
-      response = Net::HTTP.get_response(uri)
+      response = Net::HTTP.start(
+        uri.hostname,
+        uri.port,
+        use_ssl: uri.scheme == "https",
+        open_timeout: SSO_DEFAULT_OIDC_HTTP_TIMEOUT,
+        read_timeout: SSO_DEFAULT_OIDC_HTTP_TIMEOUT
+      ) { |http| http.get(uri.request_uri) }
       return {} unless response.is_a?(Net::HTTPSuccess)
+      return {} if response.body.to_s.bytesize > SSO_DEFAULT_OIDC_HTTP_MAX_BODY_SIZE
 
       normalize_hash(JSON.parse(response.body))
     rescue
@@ -342,9 +372,40 @@ module BetterAuth
     end
 
     def sso_oidc_pkce_state(provider)
-      return {} unless normalize_hash(provider["oidcConfig"] || {})[:pkce]
+      return {} unless sso_provider_config_hash(provider["oidcConfig"])[:pkce]
+
+      verifier = BetterAuth::Crypto.random_string(128)
+      {
+        codeVerifier: verifier,
+        codeChallenge: sso_base64_urlsafe(OpenSSL::Digest::SHA256.digest(verifier))
+      }
+    end
+
+    def sso_store_oidc_pkce_verifier(ctx, state, verifier)
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_OIDC_PKCE_VERIFIER_KEY_PREFIX}#{state}",
+        value: verifier,
+        expiresAt: Time.now + 600
+      )
+    end
+
+    def sso_oidc_code_verifier(ctx, state)
+      return nil if state.to_s.empty?
+
+      identifier = "#{SSO_OIDC_PKCE_VERIFIER_KEY_PREFIX}#{state}"
+      verification = ctx.context.internal_adapter.find_verification_value(identifier)
+      ctx.context.internal_adapter.delete_verification_by_identifier(identifier) if verification
+      verification&.fetch("value", nil)
+    end
 
-      {codeVerifier: BetterAuth::Crypto.random_string(128)}
+    def sso_oidc_http_timeout(value)
+      timeout = value || SSO_DEFAULT_OIDC_HTTP_TIMEOUT
+      timeout.to_f.positive? ? timeout.to_f : SSO_DEFAULT_OIDC_HTTP_TIMEOUT
+    end
+
+    def sso_oidc_http_max_body_size(value)
+      size = value || SSO_DEFAULT_OIDC_HTTP_MAX_BODY_SIZE
+      size.to_i.positive? ? size.to_i : SSO_DEFAULT_OIDC_HTTP_MAX_BODY_SIZE
     end
 
     def sso_decode_state(state, secret)
@@ -392,7 +453,8 @@ module BetterAuth
         issuer: issuer,
         existing_config: existing,
         fetch: ctx.context.options.plugins.find { |plugin| plugin.id == "sso" }&.options&.fetch(:oidc_discovery_fetch, nil),
-        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) }
+        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) },
+        timeout: ctx.context.options.plugins.find { |plugin| plugin.id == "sso" }&.options&.fetch(:oidc_http_timeout, nil)
       )
       existing.merge(discovered)
     end
@@ -404,7 +466,7 @@ module BetterAuth
     end
 
     def sso_ensure_runtime_oidc_provider(ctx, provider, plugin_config, require_jwks: false)
-      oidc_config = normalize_hash(provider["oidcConfig"] || {})
+      oidc_config = sso_provider_config_hash(provider["oidcConfig"])
       needs_discovery = sso_oidc_needs_runtime_discovery?(oidc_config) || (require_jwks && oidc_config[:jwks_endpoint].to_s.empty?)
       return provider if !needs_discovery
 
@@ -412,9 +474,29 @@ module BetterAuth
         issuer: provider.fetch("issuer"),
         existing_config: oidc_config.merge(issuer: provider.fetch("issuer")),
         fetch: plugin_config[:oidc_discovery_fetch],
-        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) }
+        trusted_origin: ->(url) { ctx.context.trusted_origin?(url, allow_relative_paths: false) },
+        timeout: plugin_config[:oidc_http_timeout]
       )
       provider.merge("oidcConfig" => oidc_config.merge(discovered))
     end
+
+    def sso_validate_oidc_endpoint_origins!(ctx, oidc_config)
+      return unless sso_oidc_trusted_origin_enforced?(ctx)
+
+      config = normalize_hash(oidc_config || {})
+      %i[authorization_endpoint token_endpoint jwks_endpoint user_info_endpoint discovery_endpoint].each do |field|
+        url = config[field]
+        next if url.to_s.empty?
+
+        sso_validate_url!(url, "OIDC #{Schema.storage_key(field)} must be a valid URL")
+        next if ctx.context.trusted_origin?(url.to_s, allow_relative_paths: false)
+
+        raise APIError.new("BAD_REQUEST", message: "OIDC #{Schema.storage_key(field)} is not trusted")
+      end
+    end
+
+    def sso_oidc_trusted_origin_enforced?(ctx)
+      Array(ctx.context.trusted_origins).map(&:to_s).uniq.length > 1
+    end
   end
 end

data/lib/better_auth/sso/plugin/provider_utils.rb

@@ -14,9 +14,9 @@ module BetterAuth
         return "#{context.base_url}#{path}"
       end
 
-      "#{context.base_url}/sso/callback/#{provider_id}"
+      "#{context.base_url}/sso/callback/#{URI.encode_www_form_component(provider_id.to_s)}"
     rescue URI::InvalidURIError
-      "#{context.base_url}/sso/callback/#{provider_id}"
+      "#{context.base_url}/sso/callback/#{URI.encode_www_form_component(provider_id.to_s)}"
     end
 
     def sso_email_domain_matches?(email_domain, provider_domain)
@@ -36,6 +36,18 @@ module BetterAuth
       provider
     end
 
+    def sso_find_saml_provider!(ctx, provider_id, config = {})
+      if config[:default_sso]
+        provider = sso_default_provider(config, provider_id: provider_id.to_s, domain: "")
+        return provider if provider && provider["samlConfig"]
+      end
+
+      provider = ctx.context.adapter.find_one(model: "ssoProvider", where: [{field: "providerId", value: provider_id.to_s}])
+      raise APIError.new("NOT_FOUND", message: "Provider not found", code: "PROVIDER_NOT_FOUND") unless provider && provider["samlConfig"]
+
+      provider
+    end
+
     def sso_provider_access?(provider, user_id, ctx)
       organization_id = provider["organizationId"]
       return provider["userId"] == user_id if organization_id.to_s.empty?
@@ -212,5 +224,18 @@ module BetterAuth
     def sso_redirect(ctx, location)
       [302, ctx.response_headers.merge("location" => location), [""]]
     end
+
+    def sso_safe_oidc_redirect_url(ctx, url)
+      app_origin = ctx.context.base_url
+      value = url.to_s
+      return app_origin if value.empty?
+
+      return value if value.start_with?("/") && !value.start_with?("//")
+      return app_origin unless ctx.context.trusted_origin?(value, allow_relative_paths: false)
+
+      value
+    rescue
+      app_origin
+    end
   end
 end

data/lib/better_auth/sso/plugin/providers.rb

@@ -5,7 +5,7 @@ module BetterAuth
     module_function
 
     def sso_register_provider_endpoint(config = {})
-      Endpoint.new(path: "/sso/register", method: "POST") do |ctx|
+      Endpoint.new(path: "/sso/register", method: "POST", metadata: sso_openapi_for(:register_provider)) do |ctx|
         session = Routes.current_session(ctx)
         body = normalize_hash(ctx.body)
         provider_id = body[:provider_id].to_s
@@ -28,6 +28,7 @@ module BetterAuth
 
         oidc_config = normalize_hash(body[:oidc_config] || {})
         oidc_config = sso_hydrate_oidc_config(body[:issuer], oidc_config, ctx) if oidc_config.any? && !oidc_config[:skip_discovery]
+        sso_validate_oidc_endpoint_origins!(ctx, oidc_config) if oidc_config.any?
         oidc_config[:override_user_info] = !!(body[:override_user_info] || config[:default_override_user_info]) if oidc_config.any?
         saml_config = normalize_hash(body[:saml_config] || {})
         sso_validate_saml_config!(saml_config, config) unless saml_config.empty?
@@ -82,7 +83,7 @@ module BetterAuth
     end
 
     def sso_update_provider_endpoint(config = {})
-      Endpoint.new(path: "/sso/update-provider", method: "POST") do |ctx|
+      Endpoint.new(path: "/sso/update-provider", method: "POST", metadata: sso_openapi_for(:update_provider)) do |ctx|
         session = Routes.current_session(ctx)
         body = normalize_hash(ctx.body)
         provider = sso_find_provider!(ctx, sso_fetch(body, :provider_id) || sso_fetch(ctx.params, :provider_id))
@@ -102,6 +103,7 @@ module BetterAuth
 
           resolved_issuer = update[:issuer] || current[:issuer] || provider["issuer"]
           update[:oidcConfig] = current.merge(normalize_hash(body[:oidc_config])).merge(issuer: resolved_issuer).compact
+          sso_validate_oidc_endpoint_origins!(ctx, update[:oidcConfig])
         end
         if body.key?(:saml_config)
           current = sso_provider_config_hash(provider["samlConfig"])
@@ -118,7 +120,7 @@ module BetterAuth
     end
 
     def sso_delete_provider_endpoint
-      Endpoint.new(path: "/sso/delete-provider", method: "POST") do |ctx|
+      Endpoint.new(path: "/sso/delete-provider", method: "POST", metadata: sso_openapi_for(:delete_provider)) do |ctx|
         session = Routes.current_session(ctx)
         provider = sso_find_provider!(ctx, sso_fetch(ctx.body, :provider_id) || sso_fetch(ctx.params, :provider_id))
         raise APIError.new("FORBIDDEN", message: "You don't have access to this provider") unless sso_provider_access?(provider, session.fetch(:user).fetch("id"), ctx)

data/lib/better_auth/sso/plugin/saml_metadata_and_logout.rb

@@ -6,13 +6,16 @@ module BetterAuth
 
     def sso_validate_saml_config!(saml_config, plugin_config = {})
       metadata = saml_config[:idp_metadata] || saml_config[:metadata] || saml_config[:idp_metadata_xml]
+      idp_metadata = normalize_hash(saml_config[:idp_metadata] || {})
+      has_idp_metadata_xml = !idp_metadata[:metadata].to_s.empty? || !saml_config[:metadata].to_s.empty? || !saml_config[:idp_metadata_xml].to_s.empty?
+      has_idp_sso_service = !Array(idp_metadata[:single_sign_on_service] || saml_config[:single_sign_on_service]).empty?
       max_metadata_size = plugin_config.dig(:saml, :max_metadata_size) || SSO_DEFAULT_MAX_SAML_METADATA_SIZE
       if metadata.to_s.bytesize > max_metadata_size
         raise APIError.new("BAD_REQUEST", message: "IdP metadata exceeds maximum allowed size (#{max_metadata_size} bytes)")
       end
 
-      if saml_config[:entry_point].to_s.empty? && saml_config[:single_sign_on_service].to_s.empty? && metadata.to_s.empty?
-        raise APIError.new("BAD_REQUEST", message: "SAML config must include entryPoint, singleSignOnService, or IdP metadata")
+      if saml_config[:entry_point].to_s.empty? && !has_idp_sso_service && !has_idp_metadata_xml
+        raise APIError.new("BAD_REQUEST", message: "SAML configuration requires either idpMetadata.metadata, idpMetadata.singleSignOnService, or a valid entryPoint URL")
       end
       sso_validate_url!(saml_config[:entry_point], "SAML entryPoint must be a valid URL") unless saml_config[:entry_point].to_s.empty?
       unless saml_config[:single_sign_on_service].to_s.empty?
@@ -49,7 +52,7 @@ module BetterAuth
 
     def sso_sp_metadata_xml(ctx, provider, config = {})
       provider_id = provider.fetch("providerId")
-      saml_config = normalize_hash(provider["samlConfig"] || {})
+      saml_config = sso_provider_config_hash(provider["samlConfig"])
       explicit_metadata = saml_config.dig(:sp_metadata, :metadata)
       return explicit_metadata unless explicit_metadata.to_s.empty?
 
@@ -57,19 +60,21 @@ module BetterAuth
       acs_url = sso_saml_acs_url(ctx, provider)
       authn_requests_signed = !!saml_config[:authn_requests_signed]
       want_assertions_signed = saml_config.key?(:want_assertions_signed) ? !!saml_config[:want_assertions_signed] : true
-      name_id_format = saml_config[:identifier_format].to_s.empty? ? "" : "<NameIDFormat>#{saml_config[:identifier_format]}</NameIDFormat>"
+      escaped_entity_id = CGI.escapeHTML(entity_id.to_s)
+      escaped_acs_url = CGI.escapeHTML(acs_url.to_s)
+      name_id_format = saml_config[:identifier_format].to_s.empty? ? "" : "<NameIDFormat>#{CGI.escapeHTML(saml_config[:identifier_format].to_s)}</NameIDFormat>"
       slo = if config.dig(:saml, :enable_single_logout)
-        location = "#{ctx.context.base_url}/sso/saml2/sp/slo/#{URI.encode_www_form_component(provider_id)}"
+        location = CGI.escapeHTML("#{ctx.context.base_url}/sso/saml2/sp/slo/#{URI.encode_www_form_component(provider_id)}")
         "<SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{location}\" /><SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"#{location}\" />"
       end
 
-      "<EntityDescriptor entityID=\"#{entity_id}\"><SPSSODescriptor AuthnRequestsSigned=\"#{authn_requests_signed}\" WantAssertionsSigned=\"#{want_assertions_signed}\">#{slo}#{name_id_format}<AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{acs_url}\" index=\"0\" /></SPSSODescriptor></EntityDescriptor>"
+      "<EntityDescriptor entityID=\"#{escaped_entity_id}\"><SPSSODescriptor AuthnRequestsSigned=\"#{authn_requests_signed}\" WantAssertionsSigned=\"#{want_assertions_signed}\">#{slo}#{name_id_format}<AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{escaped_acs_url}\" index=\"0\" /></SPSSODescriptor></EntityDescriptor>"
     end
 
     def sso_saml_acs_url(ctx, provider)
       provider_id = provider.fetch("providerId")
       base_url = ctx.context.base_url
-      configured = normalize_hash(provider["samlConfig"] || {})[:callback_url].to_s
+      configured = sso_provider_config_hash(provider["samlConfig"])[:callback_url].to_s
       return configured if sso_saml_acs_url?(configured)
 
       "#{base_url}/sso/saml2/sp/acs/#{URI.encode_www_form_component(provider_id)}"
@@ -154,12 +159,12 @@ module BetterAuth
     end
 
     def sso_saml_callback_url(provider)
-      saml_config = normalize_hash(provider["samlConfig"] || {})
+      saml_config = sso_provider_config_hash(provider["samlConfig"])
       saml_config[:callback_url]
     end
 
     def sso_saml_logout_destination(provider)
-      saml_config = normalize_hash(provider["samlConfig"] || {})
+      saml_config = sso_provider_config_hash(provider["samlConfig"])
       direct = saml_config[:single_logout_service] ||
         saml_config[:single_logout_service_url] ||
         saml_config[:idp_slo_service_url] ||
@@ -250,7 +255,13 @@ module BetterAuth
     end
 
     def sso_validate_saml_slo_signature!(ctx, raw_message, error_message)
-      return true if !sso_fetch(ctx.body, :signature).to_s.empty? || !sso_fetch(ctx.query, :signature).to_s.empty?
+      signature = sso_fetch(ctx.body, :signature) || sso_fetch(ctx.query, :signature)
+      sig_alg = sso_fetch(ctx.body, :sig_alg) || sso_fetch(ctx.query, :sig_alg)
+      if !signature.to_s.empty? && !sig_alg.to_s.empty?
+        return true if sso_validate_saml_redirect_signature(ctx, raw_message, signature, sig_alg)
+
+        raise APIError.new("BAD_REQUEST", message: error_message)
+      end
 
       xml = Base64.decode64(raw_message.to_s.gsub(/\s+/, ""))
       return true if xml.include?("<Signature") || xml.include?(":Signature")
@@ -262,6 +273,21 @@ module BetterAuth
       raise APIError.new("BAD_REQUEST", message: error_message)
     end
 
+    def sso_validate_saml_redirect_signature(ctx, raw_message, signature, sig_alg)
+      provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+      cert = sso_saml_idp_metadata(provider)[:cert]
+      certificate = OpenSSL::X509::Certificate.new(cert.to_s)
+      has_saml_request = sso_fetch(ctx.body, :saml_request) || sso_fetch(ctx.query, :saml_request)
+      saml_param = has_saml_request ? "SAMLRequest" : "SAMLResponse"
+      relay_state = sso_fetch(ctx.body, :relay_state) || sso_fetch(ctx.query, :relay_state)
+      payload = [[saml_param, raw_message]]
+      payload << ["RelayState", relay_state] unless relay_state.to_s.empty?
+      payload << ["SigAlg", sig_alg]
+      certificate.public_key.verify(sso_saml_signature_digest(sig_alg), Base64.decode64(signature.to_s), URI.encode_www_form(payload))
+    rescue
+      false
+    end
+
     def sso_parse_saml_logout_response(raw_response)
       xml = Base64.decode64(raw_response.to_s.gsub(/\s+/, ""))
       {
@@ -318,7 +344,7 @@ module BetterAuth
     end
 
     def sso_signed_saml_redirect_query(provider, query)
-      saml_config = normalize_hash(provider["samlConfig"] || {})
+      saml_config = sso_provider_config_hash(provider["samlConfig"])
       private_key = saml_config.dig(:sp_metadata, :private_key) || saml_config[:private_key] || saml_config[:sp_private_key]
       raise APIError.new("BAD_REQUEST", message: "SAML Redirect signing requires privateKey") if private_key.to_s.empty?
 

data/lib/better_auth/sso/plugin/saml_response.rb

@@ -5,7 +5,7 @@ module BetterAuth
     module_function
 
     def sso_handle_saml_response(ctx, config = {})
-      provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+      provider = sso_find_saml_provider!(ctx, sso_fetch(ctx.params, :provider_id), config)
       relay_state = sso_fetch(ctx.body, :relay_state) || sso_fetch(ctx.query, :relay_state)
       state = sso_parse_saml_relay_state(ctx, relay_state) || {}
       raw_response = sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
@@ -21,19 +21,23 @@ module BetterAuth
       if raw_response.to_s.bytesize > max_response_size
         raise APIError.new("BAD_REQUEST", message: "SAML response exceeds maximum allowed size (#{max_response_size} bytes)")
       end
-      in_response_to_error = sso_validate_saml_in_response_to(ctx, config, provider, raw_response, state)
-      return in_response_to_error if in_response_to_error
+      in_response_to_result = sso_validate_saml_in_response_to(ctx, config, provider, raw_response, state)
+      return in_response_to_result if in_response_to_result.is_a?(Array)
 
       assertion = sso_parse_saml_response(raw_response, config, provider, ctx)
       assertion[:email_verified] = false unless config[:trust_email_verified]
       sso_validate_saml_timestamp!(sso_saml_timestamp_conditions(assertion), config)
       sso_validate_saml_response!(config, assertion, provider, ctx)
-      assertion_id = assertion[:id] || assertion["id"] || assertion[:email]
-      replay_key = "#{SSO_SAML_USED_ASSERTION_KEY_PREFIX}#{assertion_id}"
-      if ctx.context.internal_adapter.find_verification_value(replay_key)
-        raise APIError.new("BAD_REQUEST", message: SSO_ERROR_CODES.fetch("SAML_RESPONSE_REPLAYED"))
+      sso_consume_saml_in_response_to(ctx, in_response_to_result)
+      assertion_id = assertion[:id] || assertion["id"]
+      unless assertion_id.to_s.empty?
+        replay_key = "#{SSO_SAML_USED_ASSERTION_KEY_PREFIX}#{assertion_id}"
+        if ctx.context.internal_adapter.find_verification_value(replay_key)
+          callback_url = sso_safe_saml_callback_url(ctx, state["callbackURL"] || sso_saml_callback_url(provider) || "/", provider.fetch("providerId"))
+          return sso_redirect(ctx, sso_append_error(callback_url, "replay_detected", "SAML assertion has already been used"))
+        end
+        ctx.context.internal_adapter.create_verification_value(identifier: replay_key, value: "used", expiresAt: sso_saml_assertion_replay_expires_at(assertion, config))
       end
-      ctx.context.internal_adapter.create_verification_value(identifier: replay_key, value: "used", expiresAt: sso_saml_assertion_replay_expires_at(assertion, config))
 
       callback_url = sso_safe_saml_callback_url(ctx, state["callbackURL"] || sso_saml_callback_url(provider) || "/", provider.fetch("providerId"))
       email = (assertion[:email] || assertion["email"]).to_s.downcase
@@ -77,6 +81,8 @@ module BetterAuth
         end
         if provider["samlConfig"]
           return {error: "account_not_linked"} unless already_linked_provider || sso_saml_trusted_provider?(ctx, provider, email)
+        elsif !already_linked_provider && !sso_oidc_trusted_provider?(ctx, provider, email)
+          return {error: "account_not_linked"}
         end
 
         user = found[:user]
@@ -87,7 +93,7 @@ module BetterAuth
             userId: user.fetch("id")
           )
         end
-        oidc_config = normalize_hash(provider["oidcConfig"] || {})
+        oidc_config = sso_provider_config_hash(provider["oidcConfig"])
         if oidc_config[:override_user_info] || config[:default_override_user_info]
           update = {}
           update[:name] = user_info[:name] if user_info.key?(:name)
@@ -124,6 +130,17 @@ module BetterAuth
       trusted || (provider["domainVerified"] && sso_email_domain_matches?(email, provider["domain"]))
     end
 
+    def sso_oidc_trusted_provider?(ctx, provider, email)
+      provider_id = provider.fetch("providerId")
+      linking = ctx.context.options.account[:account_linking] || {}
+      return false if linking[:enabled] == false
+
+      trusted_providers = Array(linking[:trusted_providers]).map(&:to_s)
+      trusted_providers.include?(provider_id.to_s) ||
+        trusted_providers.include?("sso:#{provider_id}") ||
+        (provider["domainVerified"] && sso_email_domain_matches?(email, provider["domain"]))
+    end
+
     def sso_assign_organization_membership(ctx, provider, user, config)
       organization_id = provider["organizationId"]
       return if organization_id.to_s.empty?

data/lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb

@@ -5,7 +5,7 @@ module BetterAuth
     module_function
 
     def sso_sign_in_endpoint(config = {})
-      Endpoint.new(path: "/sign-in/sso", method: "POST") do |ctx|
+      Endpoint.new(path: "/sign-in/sso", method: "POST", metadata: sso_openapi_for(:sign_in)) do |ctx|
         body = normalize_hash(ctx.body)
         provider = sso_select_provider(ctx, body, config)
         provider_type = body[:provider_type].to_s
@@ -29,11 +29,13 @@ module BetterAuth
 
         if provider["oidcConfig"] && provider_type != "saml"
           provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
+          pkce = sso_oidc_pkce_state(provider)
           state = BetterAuth::Crypto.sign_jwt(
-            state_data.merge({nonce: BetterAuth::Crypto.random_string(32)}).merge(sso_oidc_pkce_state(provider)),
+            state_data.merge({nonce: BetterAuth::Crypto.random_string(32)}).merge(pkce.except(:codeVerifier)),
             ctx.context.secret,
             expires_in: 600
           )
+          sso_store_oidc_pkce_verifier(ctx, state, pkce[:codeVerifier]) if pkce[:codeVerifier]
           url = sso_oidc_authorization_url(provider, ctx, state, config, body)
         elsif provider["samlConfig"]
           relay_state = sso_generate_saml_relay_state(ctx, state_data)
@@ -65,8 +67,8 @@ module BetterAuth
       state ||= sso_verify_state(ctx.query[:state] || ctx.query["state"], ctx.context.secret)
       return ctx.redirect("#{ctx.context.base_url}/error?error=invalid_state") unless state
 
-      callback_url = state["callbackURL"] || "/"
-      error_url = state["errorURL"] || callback_url
+      callback_url = sso_safe_oidc_redirect_url(ctx, state["callbackURL"] || "/")
+      error_url = sso_safe_oidc_redirect_url(ctx, state["errorURL"] || callback_url)
       if ctx.query[:error] || ctx.query["error"]
         error = ctx.query[:error] || ctx.query["error"]
         description = ctx.query[:error_description] || ctx.query["error_description"]
@@ -84,18 +86,19 @@ module BetterAuth
       end
 
       provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
-      oidc_config = normalize_hash(provider["oidcConfig"] || {})
+      oidc_config = sso_provider_config_hash(provider["oidcConfig"])
       oidc_config[:issuer] ||= provider["issuer"]
       return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "provider not found")) if oidc_config.empty?
 
-      tokens = sso_oidc_tokens(ctx, provider, oidc_config, state, config)
+      raw_state = ctx.query[:state] || ctx.query["state"]
+      tokens = sso_oidc_tokens(ctx, provider, oidc_config, state, config, raw_state: raw_state)
       unless tokens
         return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "token_response_not_found"))
       end
       if oidc_config[:user_info_endpoint].to_s.empty? && tokens[:id_token] && oidc_config[:jwks_endpoint].to_s.empty?
         begin
           provider = sso_ensure_runtime_oidc_provider(ctx, provider, config, require_jwks: true)
-          oidc_config = normalize_hash(provider["oidcConfig"] || {})
+          oidc_config = sso_provider_config_hash(provider["oidcConfig"])
           oidc_config[:issuer] ||= provider["issuer"]
         rescue APIError
           # Fall through to the upstream callback error when JWKS is still unavailable.
@@ -113,12 +116,14 @@ module BetterAuth
       end
 
       result = sso_find_or_create_user_result(ctx, provider, user_info, config)
+      return sso_redirect(ctx, sso_append_error(callback_url, result.fetch(:error))) if result[:error]
+
       if config[:provision_user].respond_to?(:call) && (result.fetch(:created) || config[:provision_user_on_every_login])
         config[:provision_user].call(user: result.fetch(:user), userInfo: user_info, token: tokens, provider: provider)
       end
       session = ctx.context.internal_adapter.create_session(result.fetch(:user).fetch("id"))
       Cookies.set_session_cookie(ctx, {session: session, user: result.fetch(:user)})
-      redirect_to = (result.fetch(:created) && state["newUserURL"].to_s != "") ? state["newUserURL"] : callback_url
+      redirect_to = (result.fetch(:created) && state["newUserURL"].to_s != "") ? sso_safe_oidc_redirect_url(ctx, state["newUserURL"]) : callback_url
       sso_redirect(ctx, redirect_to || "/")
     end
   end

data/lib/better_auth/sso/routes/schemas.rb

@@ -59,7 +59,7 @@ module BetterAuth
           end
           {
             ssoProvider: {
-              model_name: normalized[:model_name] || "ssoProviders",
+              model_name: normalized[:model_name] || "sso_providers",
               fields: fields
             }
           }

data/lib/better_auth/sso/saml.rb

@@ -66,7 +66,7 @@ module BetterAuth
           name = [given_name, family_name].compact.join(" ").strip
           name = mapped_attribute(attributes, mapping[:name]) || first_attribute(attributes, attribute_map.fetch(:name)) if name.empty?
           extra_fields = mapped_extra_fields(attributes, mapping)
-          email_verified = mapping[:email_verified] ? mapped_attribute(attributes, mapping[:email_verified]) : true
+          email_verified = mapping[:email_verified] ? mapped_attribute(attributes, mapping[:email_verified]) : false
           extra_fields.merge(
             email: email.to_s.downcase,
             name: name.to_s.empty? ? email.to_s : name.to_s,

data/lib/better_auth/sso/version.rb

@@ -2,7 +2,7 @@
 
 module BetterAuth
   module SSO
-    VERSION = "0.8.0"
+    VERSION = "0.10.0"
     PACKAGE_VERSION = VERSION
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth-sso
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Sebastian Sala
@@ -203,14 +203,14 @@ files:
 - lib/better_auth/sso/types.rb
 - lib/better_auth/sso/utils.rb
 - lib/better_auth/sso/version.rb
-homepage: https://github.com/sebasxsala/better-auth
+homepage: https://github.com/sebasxsala/better-auth-rb
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/sebasxsala/better-auth
-  source_code_uri: https://github.com/sebasxsala/better-auth
-  changelog_uri: https://github.com/sebasxsala/better-auth/blob/main/packages/better_auth-sso/CHANGELOG.md
-  bug_tracker_uri: https://github.com/sebasxsala/better-auth/issues
+  homepage_uri: https://github.com/sebasxsala/better-auth-rb
+  source_code_uri: https://github.com/sebasxsala/better-auth-rb
+  changelog_uri: https://github.com/sebasxsala/better-auth-rb/blob/main/packages/better_auth-sso/CHANGELOG.md
+  bug_tracker_uri: https://github.com/sebasxsala/better-auth-rb/issues
 rdoc_options: []
 require_paths:
 - lib