@better-auth/core 1.6.21 → 1.6.22

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.6.21";
+const __betterAuthVersion = "1.6.22";
 /**
 * We store context instance in the globalThis.
 *

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.6.21";
+const INSTRUMENTATION_VERSION = "1.6.22";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/client-credentials-token.mjs

@@ -1,5 +1,5 @@
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { base64Url } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/client-credentials-token.ts
 async function clientCredentialsTokenRequest({ options, scope, authentication, resource }) {
 	options = typeof options === "function" ? await options() : options;
@@ -43,7 +43,7 @@ async function clientCredentialsToken({ options, tokenEndpoint, scope, authentic
 		authentication,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers

package/dist/oauth2/refresh-access-token.mjs

@@ -1,5 +1,5 @@
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/refresh-access-token.ts
 async function refreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
 	options = typeof options === "function" ? await options() : options;
@@ -46,7 +46,7 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 		authentication,
 		extraParams
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers

package/dist/oauth2/reject-redirects.mjs

@@ -0,0 +1,60 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/oauth2/reject-redirects.ts
+const HTTP_REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/**
+* Whether a response from a `redirect: "manual"` fetch is a redirect.
+*
+* Node/undici exposes the real 3xx status. Spec-compliant runtimes (Cloudflare
+* Workers, Deno, browsers) return an opaque-redirect filtered response with
+* status 0 and type `"opaqueredirect"`, so the status alone is not enough.
+*/
+function isRedirectResponse(response) {
+	return response.type === "opaqueredirect" || HTTP_REDIRECT_STATUSES.has(response.status);
+}
+function redirectRefused(endpoint) {
+	return new BetterAuthError(`The OAuth endpoint "${endpoint}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`);
+}
+/**
+* Fetch option that refuses HTTP redirects portably.
+*
+* Cloudflare Workers (workerd) rejects `redirect: "error"`, so manual mode is
+* used and the resolved response is checked with {@link assertResponseNotRedirect}
+* (or, for betterFetch, with {@link fetchRefusingRedirects}).
+*/
+const NO_FOLLOW_REDIRECT = { redirect: "manual" };
+/**
+* Throw when a native-`fetch` response (e.g. jose's JWKS loader) resolved to a
+* redirect, so an attacker-influenced endpoint cannot bounce a server-side
+* request to an internal address.
+*/
+function assertResponseNotRedirect(endpoint, response) {
+	if (isRedirectResponse(response)) throw redirectRefused(endpoint);
+}
+/**
+* betterFetch that refuses HTTP redirects on a server-side OAuth fetch.
+*
+* Returns the betterFetch result and throws if the endpoint redirected, on both
+* undici (real 3xx status) and spec-compliant runtimes (opaque redirect, where
+* the error status is 0). The redirect is never followed on any runtime.
+*/
+async function fetchRefusingRedirects(url, options) {
+	let redirected = false;
+	const result = await betterFetch(url, {
+		...options,
+		...NO_FOLLOW_REDIRECT,
+		onError(context) {
+			if (isRedirectResponse(context.response)) redirected = true;
+		}
+	});
+	if (redirected) throw redirectRefused(url);
+	return result;
+}
+//#endregion
+export { NO_FOLLOW_REDIRECT, assertResponseNotRedirect, fetchRefusingRedirects };

package/dist/oauth2/validate-authorization-code.mjs

@@ -1,7 +1,7 @@
+import { NO_FOLLOW_REDIRECT, assertResponseNotRedirect, fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { getOAuth2Tokens } from "./utils.mjs";
 import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 //#region src/oauth2/validate-authorization-code.ts
 async function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams = {}, resource }) {
 	options = typeof options === "function" ? await options() : options;
@@ -61,7 +61,7 @@ async function validateAuthorizationCode({ code, codeVerifier, redirectURI, opti
 		additionalParams,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers: requestHeaders
@@ -70,7 +70,14 @@ async function validateAuthorizationCode({ code, codeVerifier, redirectURI, opti
 	return getOAuth2Tokens(data);
 }
 async function validateToken(token, jwksEndpoint, options) {
-	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint)), {
+	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: async (url, init) => {
+		const response = await fetch(url, {
+			...init,
+			...NO_FOLLOW_REDIRECT
+		});
+		assertResponseNotRedirect(String(url), response);
+		return response;
+	} }), {
 		audience: options?.audience,
 		issuer: options?.issuer
 	});

package/dist/oauth2/verify.mjs

@@ -1,6 +1,6 @@
 import { logger } from "../env/logger.mjs";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { APIError } from "better-call";
-import { betterFetch } from "@better-fetch/fetch";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
 const joseInfrastructureErrorCodes = new Set([
@@ -44,7 +44,7 @@ function shouldRefetchCachedJwksWithoutKid(error, resolved) {
 	return Date.now() - resolved.noKidRefetchedAt >= JWKS_NO_KID_REFETCH_COOLDOWN_MS;
 }
 async function fetchJwks(jwksFetch) {
-	const jwks = typeof jwksFetch === "string" ? await betterFetch(jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
+	const jwks = typeof jwksFetch === "string" ? await fetchRefusingRedirects(jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
 		if (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);
 		return res.data;
 	}) : await jwksFetch();
@@ -166,7 +166,7 @@ async function verifyAccessToken(token, opts) {
 		else throw new Error(error);
 	}
 	if (opts?.remoteVerify) {
-		const { data: introspect, error: introspectError } = await betterFetch(opts.remoteVerify.introspectUrl, {
+		const { data: introspect, error: introspectError } = await fetchRefusingRedirects(opts.remoteVerify.introspectUrl, {
 			method: "POST",
 			headers: {
 				Accept: "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.6.21",
+  "version": "1.6.22",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",

package/src/oauth2/client-credentials-token.ts

@@ -1,7 +1,7 @@
 import { base64Url } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
 import type { AwaitableFunction } from "../types";
 import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
+import { fetchRefusingRedirects } from "./reject-redirects";
 
 export async function clientCredentialsTokenRequest({
 	options,
@@ -96,7 +96,7 @@ export async function clientCredentialsToken({
 		resource,
 	});
 
-	const { data, error } = await betterFetch<{
+	const { data, error } = await fetchRefusingRedirects<{
 		access_token: string;
 		expires_in?: number | undefined;
 		token_type?: string | undefined;

package/src/oauth2/refresh-access-token.ts

@@ -1,7 +1,7 @@
 import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
 import type { AwaitableFunction } from "../types";
 import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
+import { fetchRefusingRedirects } from "./reject-redirects";
 
 export async function refreshAccessTokenRequest({
 	refreshToken,
@@ -115,7 +115,7 @@ export async function refreshAccessToken({
 		extraParams,
 	});
 
-	const { data, error } = await betterFetch<{
+	const { data, error } = await fetchRefusingRedirects<{
 		access_token: string;
 		refresh_token?: string | undefined;
 		expires_in?: number | undefined;

package/src/oauth2/reject-redirects.ts

@@ -0,0 +1,70 @@
+// cspell:ignore workerd
+import type { BetterFetchOption } from "@better-fetch/fetch";
+import { betterFetch } from "@better-fetch/fetch";
+import { BetterAuthError } from "../error";
+
+const HTTP_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+/**
+ * Whether a response from a `redirect: "manual"` fetch is a redirect.
+ *
+ * Node/undici exposes the real 3xx status. Spec-compliant runtimes (Cloudflare
+ * Workers, Deno, browsers) return an opaque-redirect filtered response with
+ * status 0 and type `"opaqueredirect"`, so the status alone is not enough.
+ */
+function isRedirectResponse(response: Response): boolean {
+	return (
+		response.type === "opaqueredirect" ||
+		HTTP_REDIRECT_STATUSES.has(response.status)
+	);
+}
+
+function redirectRefused(endpoint: string): BetterAuthError {
+	return new BetterAuthError(
+		`The OAuth endpoint "${endpoint}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`,
+	);
+}
+
+/**
+ * Fetch option that refuses HTTP redirects portably.
+ *
+ * Cloudflare Workers (workerd) rejects `redirect: "error"`, so manual mode is
+ * used and the resolved response is checked with {@link assertResponseNotRedirect}
+ * (or, for betterFetch, with {@link fetchRefusingRedirects}).
+ */
+export const NO_FOLLOW_REDIRECT = { redirect: "manual" } as const;
+
+/**
+ * Throw when a native-`fetch` response (e.g. jose's JWKS loader) resolved to a
+ * redirect, so an attacker-influenced endpoint cannot bounce a server-side
+ * request to an internal address.
+ */
+export function assertResponseNotRedirect(
+	endpoint: string,
+	response: Response,
+): void {
+	if (isRedirectResponse(response)) throw redirectRefused(endpoint);
+}
+
+/**
+ * betterFetch that refuses HTTP redirects on a server-side OAuth fetch.
+ *
+ * Returns the betterFetch result and throws if the endpoint redirected, on both
+ * undici (real 3xx status) and spec-compliant runtimes (opaque redirect, where
+ * the error status is 0). The redirect is never followed on any runtime.
+ */
+export async function fetchRefusingRedirects<T>(
+	url: string,
+	options?: BetterFetchOption,
+) {
+	let redirected = false;
+	const result = await betterFetch<T>(url, {
+		...options,
+		...NO_FOLLOW_REDIRECT,
+		onError(context) {
+			if (isRedirectResponse(context.response)) redirected = true;
+		},
+	});
+	if (redirected) throw redirectRefused(url);
+	return result;
+}

package/src/oauth2/validate-authorization-code.ts

@@ -1,9 +1,13 @@
 import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 import type { AwaitableFunction } from "../types";
 import type { ProviderOptions } from "./index";
 import { getOAuth2Tokens } from "./index";
+import {
+	assertResponseNotRedirect,
+	fetchRefusingRedirects,
+	NO_FOLLOW_REDIRECT,
+} from "./reject-redirects";
 
 export async function authorizationCodeRequest({
 	code,
@@ -151,7 +155,7 @@ export async function validateAuthorizationCode({
 		resource,
 	});
 
-	const { data, error } = await betterFetch<object>(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects<object>(tokenEndpoint, {
 		method: "POST",
 		body: body,
 		headers: requestHeaders,
@@ -171,7 +175,13 @@ export async function validateToken(
 		issuer?: string | string[];
 	},
 ) {
-	const jwks = createRemoteJWKSet(new URL(jwksEndpoint));
+	const jwks = createRemoteJWKSet(new URL(jwksEndpoint), {
+		[customFetch]: async (url, init) => {
+			const response = await fetch(url, { ...init, ...NO_FOLLOW_REDIRECT });
+			assertResponseNotRedirect(String(url), response);
+			return response;
+		},
+	});
 	const verified = await jwtVerify(token, jwks, {
 		audience: options?.audience,
 		issuer: options?.issuer,

package/src/oauth2/verify.ts

@@ -1,4 +1,3 @@
-import { betterFetch } from "@better-fetch/fetch";
 import { APIError } from "better-call";
 import type {
 	JSONWebKeySet,
@@ -15,6 +14,7 @@ import {
 	UnsecuredJWT,
 } from "jose";
 import { logger } from "../env";
+import { fetchRefusingRedirects } from "./reject-redirects";
 
 const joseInfrastructureErrorCodes = new Set([
 	joseErrors.JWKSTimeout.code,
@@ -107,7 +107,7 @@ async function fetchJwks(
 ): Promise<JSONWebKeySet> {
 	const jwks =
 		typeof jwksFetch === "string"
-			? await betterFetch<JSONWebKeySet>(jwksFetch, {
+			? await fetchRefusingRedirects<JSONWebKeySet>(jwksFetch, {
 					headers: {
 						Accept: "application/json",
 					},
@@ -332,23 +332,24 @@ export async function verifyAccessToken(
 
 	// Remote verify
 	if (opts?.remoteVerify) {
-		const { data: introspect, error: introspectError } = await betterFetch<
-			JWTPayload & {
-				active: boolean;
-			}
-		>(opts.remoteVerify.introspectUrl, {
-			method: "POST",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded",
-			},
-			body: new URLSearchParams({
-				client_id: opts.remoteVerify.clientId,
-				client_secret: opts.remoteVerify.clientSecret,
-				token,
-				token_type_hint: "access_token",
-			}).toString(),
-		});
+		const { data: introspect, error: introspectError } =
+			await fetchRefusingRedirects<
+				JWTPayload & {
+					active: boolean;
+				}
+			>(opts.remoteVerify.introspectUrl, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					"Content-Type": "application/x-www-form-urlencoded",
+				},
+				body: new URLSearchParams({
+					client_id: opts.remoteVerify.clientId,
+					client_secret: opts.remoteVerify.clientSecret,
+					token,
+					token_type_hint: "access_token",
+				}).toString(),
+			});
 		if (introspectError)
 			logger.error(
 				`Introspection failed: ${introspectError.message ?? introspectError.statusText}`,