@better-auth/sso 1.6.22 → 1.6.24

package/dist/client.d.mts

@@ -1,5 +1,4 @@
-import { t as SSOPlugin } from "./index-D9brFUE1.mjs";
-
+import { t as SSOPlugin } from "./index-P-Jf_8P1.mjs";
 //#region src/client.d.ts
 interface SSOClientOptions {
   domainVerification?: {

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CD3Z0v2C.mjs";
+import { t as PACKAGE_VERSION } from "./version-DsNmK8I4.mjs";
 //#region src/client.ts
 const ssoClient = (options) => {
 	return {

package/dist/{index-D9brFUE1.d.mts → index-P-Jf_8P1.d.mts}

@@ -1,8 +1,6 @@
 import { APIError } from "better-auth/api";
 import * as z from "zod";
 import { Awaitable, BetterAuthPlugin, OAuth2Tokens, User } from "better-auth";
-import * as better_call0 from "better-call";
-
 //#region src/saml/algorithms.d.ts
 declare const SignatureAlgorithm: {
   readonly RSA_SHA1: "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
@@ -80,6 +78,12 @@ interface SAMLConfig {
   entryPoint: string;
   cert: string;
   callbackUrl: string;
+  /**
+   * Fallback absolute URL or same-origin relative path for IdP-initiated SAML
+   * responses when `RelayState` does not contain a safe callback, including
+   * validation error redirects.
+   */
+  idpInitiatedCallbackUrl?: string | undefined;
   audience?: string | undefined;
   idpMetadata?: {
     metadata?: string;
@@ -421,11 +425,17 @@ interface SSOOptions {
      * @default false
      */
     wantLogoutResponseSigned?: boolean;
+    /**
+     * Fallback absolute URL or same-origin relative path for IdP-initiated SAML
+     * responses when `RelayState` does not contain a safe callback, including
+     * validation error redirects.
+     */
+    idpInitiatedCallbackUrl?: string | undefined;
   };
 }
 //#endregion
 //#region src/routes/domain-verification.d.ts
-declare const requestDomainVerification: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/request-domain-verification", {
+declare const requestDomainVerification: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/request-domain-verification", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -447,7 +457,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -473,7 +483,7 @@ declare const requestDomainVerification: (options: SSOOptions) => better_call0.S
 }, {
   domainVerificationToken: string;
 }>;
-declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/verify-domain", {
+declare const verifyDomain: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/verify-domain", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -498,7 +508,7 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
       };
     };
   };
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -524,9 +534,9 @@ declare const verifyDomain: (options: SSOOptions) => better_call0.StrictEndpoint
 }, void>;
 //#endregion
 //#region src/routes/providers.d.ts
-declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/providers", {
+declare const listSSOProviders: () => import("better-call").StrictEndpoint<"/sso/providers", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -583,6 +593,7 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
     samlConfig: {
       entryPoint: string;
       callbackUrl: string;
+      idpInitiatedCallbackUrl: string | undefined;
       audience: string | undefined;
       wantAssertionsSigned: boolean | undefined;
       authnRequestsSigned: boolean | undefined;
@@ -601,9 +612,9 @@ declare const listSSOProviders: () => better_call0.StrictEndpoint<"/sso/provider
     spMetadataUrl: string;
   }[];
 }>;
-declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provider", {
+declare const getSSOProvider: () => import("better-call").StrictEndpoint<"/sso/get-provider", {
   method: "GET";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -668,6 +679,7 @@ declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provid
   samlConfig: {
     entryPoint: string;
     callbackUrl: string;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -685,9 +697,9 @@ declare const getSSOProvider: () => better_call0.StrictEndpoint<"/sso/get-provid
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEndpoint<"/sso/update-provider", {
+declare const updateSSOProvider: (options: SSOOptions) => import("better-call").StrictEndpoint<"/sso/update-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -741,6 +753,7 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
       entryPoint: z.ZodOptional<z.ZodString>;
       cert: z.ZodOptional<z.ZodString>;
       callbackUrl: z.ZodOptional<z.ZodString>;
+      idpInitiatedCallbackUrl: z.ZodOptional<z.ZodString>;
       audience: z.ZodOptional<z.ZodString>;
       idpMetadata: z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
@@ -825,6 +838,7 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   samlConfig: {
     entryPoint: string;
     callbackUrl: string;
+    idpInitiatedCallbackUrl: string | undefined;
     audience: string | undefined;
     wantAssertionsSigned: boolean | undefined;
     authnRequestsSigned: boolean | undefined;
@@ -842,9 +856,9 @@ declare const updateSSOProvider: (options: SSOOptions) => better_call0.StrictEnd
   } | undefined;
   spMetadataUrl: string;
 }>;
-declare const deleteSSOProvider: () => better_call0.StrictEndpoint<"/sso/delete-provider", {
+declare const deleteSSOProvider: () => import("better-call").StrictEndpoint<"/sso/delete-provider", {
   method: "POST";
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -913,7 +927,7 @@ interface SAMLConditions {
 declare function validateSAMLTimestamp(conditions: SAMLConditions | undefined, options?: TimestampValidationOptions): void;
 //#endregion
 //#region src/routes/sso.d.ts
-declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/metadata", {
+declare const spMetadata: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/metadata", {
   method: "GET";
   query: z.ZodObject<{
     providerId: z.ZodString;
@@ -935,7 +949,7 @@ declare const spMetadata: (options?: SSOOptions) => better_call0.StrictEndpoint<
     };
   };
 }, Response>;
-declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_call0.StrictEndpoint<"/sso/register", {
+declare const registerSSOProvider: <O extends SSOOptions>(options: O) => import("better-call").StrictEndpoint<"/sso/register", {
   method: "POST";
   body: z.ZodObject<{
     providerId: z.ZodString;
@@ -969,6 +983,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
       entryPoint: z.ZodString;
       cert: z.ZodString;
       callbackUrl: z.ZodString;
+      idpInitiatedCallbackUrl: z.ZodOptional<z.ZodString>;
       audience: z.ZodOptional<z.ZodString>;
       idpMetadata: z.ZodOptional<z.ZodObject<{
         metadata: z.ZodOptional<z.ZodString>;
@@ -1015,7 +1030,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
     organizationId: z.ZodOptional<z.ZodString>;
     overrideUserInfo: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1213,7 +1228,7 @@ declare const registerSSOProvider: <O extends SSOOptions>(options: O) => better_
   oidcConfig: OIDCConfig | null;
   samlConfig: SAMLConfig | null;
 } & Omit<SSOProvider<O>, "oidcConfig" | "samlConfig">>;
-declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sign-in/sso", {
+declare const signInSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sign-in/sso", {
   method: "POST";
   body: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
@@ -1307,7 +1322,7 @@ declare const signInSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"
   url: string;
   redirect: boolean;
 }>;
-declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback/:providerId", {
+declare const callbackSSO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback/:providerId", {
   method: "GET";
   query: z.ZodObject<{
     code: z.ZodOptional<z.ZodString>;
@@ -1335,7 +1350,7 @@ declare const callbackSSO: (options?: SSOOptions) => better_call0.StrictEndpoint
  * Used when `options.redirectURI` is set — the `providerId` is read from
  * the OAuth state instead of the URL path.
  */
-declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/callback", {
+declare const callbackSSOShared: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/callback", {
   metadata: {
     openapi: {
       operationId: string;
@@ -1358,7 +1373,7 @@ declare const callbackSSOShared: (options?: SSOOptions) => better_call0.StrictEn
   }, z.core.$strip>;
   allowedMediaTypes: readonly ["application/x-www-form-urlencoded", "application/json"];
 }, void>;
-declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
+declare const callbackSSOSAML: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/callback/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1388,7 +1403,7 @@ declare const callbackSSOSAML: (options?: SSOOptions) => better_call0.StrictEndp
     scope: "server";
   };
 }, never>;
-declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
+declare const acsEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     SAMLResponse: z.ZodString;
@@ -1409,7 +1424,7 @@ declare const acsEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, never>;
-declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
+declare const sloEndpoint: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/sp/slo/:providerId", {
   method: ("GET" | "POST")[];
   body: z.ZodOptional<z.ZodObject<{
     SAMLRequest: z.ZodOptional<z.ZodString>;
@@ -1430,12 +1445,12 @@ declare const sloEndpoint: (options?: SSOOptions) => better_call0.StrictEndpoint
     scope: "server";
   };
 }, void | Response>;
-declare const initiateSLO: (options?: SSOOptions) => better_call0.StrictEndpoint<"/sso/saml2/logout/:providerId", {
+declare const initiateSLO: (options?: SSOOptions) => import("better-call").StrictEndpoint<"/sso/saml2/logout/:providerId", {
   method: "POST";
   body: z.ZodObject<{
     callbackURL: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
-  use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+  use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
     session: {
       session: Record<string, any> & {
         id: string;
@@ -1560,7 +1575,27 @@ interface OIDCDiscoveryDocument {
 /**
  * Error codes for OIDC discovery operations.
  */
-type DiscoveryErrorCode = /** Request to discovery endpoint timed out */"discovery_timeout" /** Discovery endpoint returned 404 or similar */ | "discovery_not_found" /** Discovery endpoint returned invalid JSON */ | "discovery_invalid_json" /** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */ | "discovery_invalid_url" /** OIDC endpoint URL is not trusted by the trusted origins configuration */ | "discovery_untrusted_origin" /** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */ | "discovery_private_host" /** Discovery document issuer doesn't match configured issuer */ | "issuer_mismatch" /** Discovery document is missing required fields */ | "discovery_incomplete" /** IdP only advertises token auth methods that Better Auth doesn't currently support */ | "unsupported_token_auth_method" /** Catch-all for unexpected errors */ | "discovery_unexpected_error";
+type DiscoveryErrorCode =
+/** Request to discovery endpoint timed out */
+"discovery_timeout" |
+/** Discovery endpoint returned 404 or similar */
+"discovery_not_found" |
+/** Discovery endpoint returned invalid JSON */
+"discovery_invalid_json" |
+/** OIDC endpoint URL (discovery or per-endpoint: authorization, token, userinfo, jwks) is invalid, malformed, or uses a non-`http(s)` scheme */
+"discovery_invalid_url" |
+/** OIDC endpoint URL is not trusted by the trusted origins configuration */
+"discovery_untrusted_origin" |
+/** OIDC endpoint URL (discovery or per-endpoint) points to a host that is not publicly routable (loopback, RFC 1918, link-local, cloud metadata FQDN, etc.) */
+"discovery_private_host" |
+/** Discovery document issuer doesn't match configured issuer */
+"issuer_mismatch" |
+/** Discovery document is missing required fields */
+"discovery_incomplete" |
+/** IdP only advertises token auth methods that Better Auth doesn't currently support */
+"unsupported_token_auth_method" |
+/** Catch-all for unexpected errors */
+"discovery_unexpected_error";
 /**
  * Custom error class for OIDC discovery failures.
  * Can be caught and mapped to APIError at the edge.

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-D9brFUE1.mjs";
-export { AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DeprecatedAlgorithmBehavior, DigestAlgorithm, DiscoverOIDCConfigParams, DiscoveryError, DiscoveryErrorCode, HydratedOIDCConfig, KeyEncryptionAlgorithm, OIDCConfig, OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, RequiredDiscoveryField, SAMLConditions, SAMLConfig, SSOOptions, SSOPlugin, SSOProvider, SignatureAlgorithm, TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+import { A as DataEncryptionAlgorithm, C as TimestampValidationOptions, D as SSOOptions, E as SAMLConfig, M as DigestAlgorithm, N as KeyEncryptionAlgorithm, O as SSOProvider, P as SignatureAlgorithm, S as SAMLConditions, T as OIDCConfig, _ as REQUIRED_DISCOVERY_FIELDS, a as fetchDiscoveryDocument, b as DEFAULT_MAX_SAML_METADATA_SIZE, c as normalizeUrl, d as validateDiscoveryUrl, f as DiscoverOIDCConfigParams, g as OIDCDiscoveryDocument, h as HydratedOIDCConfig, i as discoverOIDCConfig, j as DeprecatedAlgorithmBehavior, k as AlgorithmValidationOptions, l as selectTokenEndpointAuthMethod, m as DiscoveryErrorCode, n as sso, o as needsRuntimeDiscovery, p as DiscoveryError, r as computeDiscoveryUrl, s as normalizeDiscoveryUrls, t as SSOPlugin, u as validateDiscoveryDocument, v as RequiredDiscoveryField, w as validateSAMLTimestamp, x as DEFAULT_MAX_SAML_RESPONSE_SIZE, y as DEFAULT_CLOCK_SKEW_MS } from "./index-P-Jf_8P1.mjs";
+export { type AlgorithmValidationOptions, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, type DeprecatedAlgorithmBehavior, DigestAlgorithm, type DiscoverOIDCConfigParams, DiscoveryError, type DiscoveryErrorCode, type HydratedOIDCConfig, KeyEncryptionAlgorithm, type OIDCConfig, type OIDCDiscoveryDocument, REQUIRED_DISCOVERY_FIELDS, type RequiredDiscoveryField, type SAMLConditions, type SAMLConfig, type SSOOptions, SSOPlugin, type SSOProvider, SignatureAlgorithm, type TimestampValidationOptions, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-CD3Z0v2C.mjs";
+import { t as PACKAGE_VERSION } from "./version-DsNmK8I4.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
@@ -58,6 +58,8 @@ const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
 const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
 //#endregion
 //#region src/utils.ts
+const unsafeSAMLRedirectPathPrefix = /^\/(?:\/|\\|%2f|%5c)/i;
+const isSafeSAMLRedirectPath = (url) => url.startsWith("/") && !unsafeSAMLRedirectPathPrefix.test(url);
 /**
 * Safely parses a value that might be a JSON string or already a parsed object.
 * This handles cases where ORMs like Drizzle might return already parsed objects
@@ -1105,6 +1107,8 @@ function validateSAMLResponseBinding(samlContent, options) {
 }
 //#endregion
 //#region src/routes/schemas.ts
+const absoluteUrlSchema = z.url();
+const samlRedirectUrlSchema = z.string().refine((url) => isSafeSAMLRedirectPath(url) || absoluteUrlSchema.safeParse(url).success, { message: "Expected an absolute URL or a relative path starting with /" });
 const oidcMappingSchema = z.object({
 	id: z.string().optional(),
 	email: z.string().optional(),
@@ -1140,6 +1144,7 @@ const samlConfigSchema = z.object({
 	entryPoint: z.string().url().optional(),
 	cert: z.string().optional(),
 	callbackUrl: z.string().url().optional(),
+	idpInitiatedCallbackUrl: samlRedirectUrlSchema.optional(),
 	audience: z.string().optional(),
 	idpMetadata: z.object({
 		metadata: z.string().optional(),
@@ -1292,6 +1297,7 @@ function sanitizeProvider(provider, baseURL) {
 		samlConfig: samlConfig ? {
 			entryPoint: samlConfig.entryPoint,
 			callbackUrl: samlConfig.callbackUrl,
+			idpInitiatedCallbackUrl: samlConfig.idpInitiatedCallbackUrl,
 			audience: samlConfig.audience,
 			wantAssertionsSigned: samlConfig.wantAssertionsSigned,
 			authnRequestsSigned: samlConfig.authnRequestsSigned,
@@ -1395,6 +1401,7 @@ function mergeSAMLConfig(current, updates, issuer) {
 		entryPoint: updates.entryPoint ?? current.entryPoint,
 		cert: updates.cert ?? current.cert,
 		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
+		idpInitiatedCallbackUrl: updates.idpInitiatedCallbackUrl ?? current.idpInitiatedCallbackUrl,
 		spMetadata: updates.spMetadata ?? current.spMetadata,
 		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
 		mapping: updates.mapping ?? current.mapping,
@@ -1686,6 +1693,9 @@ async function generateRelayState(c, link, additionalData) {
 		errorURL: c.body.errorCallbackURL,
 		newUserURL: c.body.newUserCallbackURL,
 		link,
+		/**
+		* This is the actual expiry time of the state
+		*/
 		expiresAt: Date.now() + 600 * 1e3,
 		requestSignUp: c.body.requestSignUp
 	};
@@ -1706,6 +1716,10 @@ async function parseRelayState(c) {
 	try {
 		parsedData = await parseGenericState(c, state, {
 			cookieName: "relay_state",
+			/**
+			* SAML ACS receives a POST from the IdP, which is typically cross-origin.
+			* SameSite=Lax (default) cookies are not sent on cross-site POST requests.
+			*/
 			skipStateCookieCheck: true
 		});
 	} catch (error) {
@@ -1864,37 +1878,65 @@ function validateSAMLTimestamp(conditions, options = {}) {
 }
 //#endregion
 //#region src/routes/saml-pipeline.ts
-/**
-* Validates and returns a safe redirect URL.
-* - Prevents open redirect attacks by validating against trusted origins
-* - Prevents redirect loops by checking if URL points to callback route
-* - Falls back to appOrigin if URL is invalid or unsafe
-*/
-function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
-	if (!url) return appOrigin;
-	if (url.startsWith("/") && !url.startsWith("//")) {
+function getSafeRedirectCandidate(url, callbackPathname, appOrigin, isTrustedOrigin) {
+	if (!url) return;
+	if (url.startsWith("/")) {
+		if (!isSafeSAMLRedirectPath(url)) return;
 		try {
 			const absoluteUrl = new URL(url, appOrigin);
-			if (absoluteUrl.origin !== appOrigin) return appOrigin;
-			const callbackPathname = new URL(callbackPath).pathname;
-			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
+			if (absoluteUrl.origin !== appOrigin || absoluteUrl.pathname === callbackPathname) return;
+			return url;
 		} catch {
-			return appOrigin;
+			return;
 		}
-		return url;
 	}
-	if (!isTrustedOrigin(url, { allowRelativePaths: false })) return appOrigin;
+	let absoluteUrl;
 	try {
-		const callbackPathname = new URL(callbackPath).pathname;
-		if (new URL(url).pathname === callbackPathname) return appOrigin;
+		absoluteUrl = new URL(url);
 	} catch {
-		if (url === callbackPath || url.startsWith(`${callbackPath}?`)) return appOrigin;
+		return;
 	}
+	if (absoluteUrl.origin !== appOrigin && !isTrustedOrigin(url, { allowRelativePaths: false })) return;
+	if (absoluteUrl.origin === appOrigin && absoluteUrl.pathname === callbackPathname) return;
 	return url;
 }
+/**
+* Returns the first safe redirect URL from an ordered list of candidates.
+* - Prevents open redirect attacks by validating against trusted origins
+* - Prevents redirect loops by checking if URL points to callback route
+* - Tries the next candidate when a URL is invalid or unsafe
+* - Falls back to appOrigin when no candidate is safe
+*/
+function getSafeRedirectUrl(candidates, callbackPath, appOrigin, isTrustedOrigin) {
+	const callbackPathname = new URL(callbackPath).pathname;
+	for (const candidate of candidates) {
+		const safeCandidate = getSafeRedirectCandidate(candidate, callbackPathname, appOrigin, isTrustedOrigin);
+		if (safeCandidate) return safeCandidate;
+	}
+	return appOrigin;
+}
 function buildSAMLRedirectUrl(url, params) {
 	const searchParams = new URLSearchParams(params);
-	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
+	try {
+		const isRelativePath = url.startsWith("/") && !url.startsWith("//");
+		const parsedUrl = new URL(url, "http://better-auth.local");
+		for (const [key, value] of searchParams) parsedUrl.searchParams.set(key, value);
+		if (isRelativePath) return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;
+		return parsedUrl.toString();
+	} catch {
+		const hashIndex = url.indexOf("#");
+		const urlWithoutFragment = hashIndex === -1 ? url : url.slice(0, hashIndex);
+		const fragment = hashIndex === -1 ? "" : url.slice(hashIndex);
+		return `${urlWithoutFragment}${urlWithoutFragment.includes("?") ? "&" : "?"}${searchParams.toString()}${fragment}`;
+	}
+}
+function getSAMLRedirectCandidates(relayStateCallbackUrl, samlConfig, samlOptions) {
+	return [
+		relayStateCallbackUrl,
+		samlConfig?.idpInitiatedCallbackUrl,
+		samlOptions?.idpInitiatedCallbackUrl,
+		samlConfig?.callbackUrl
+	];
 }
 function toArray(value) {
 	if (Array.isArray(value)) return value;
@@ -1962,7 +2004,10 @@ async function processSAMLResponse(ctx, params, options) {
 	if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId, { clockSkew: options?.saml?.clockSkew });
 	const idp = createIdP(parsedSamlConfig);
-	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const redirectCandidates = getSAMLRedirectCandidates(relayState?.callbackURL, parsedSamlConfig, options?.saml);
+	const samlRedirectUrl = getSafeRedirectUrl(redirectCandidates, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const samlErrorRedirectUrl = getSafeRedirectUrl([relayState?.errorURL, samlRedirectUrl], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	params.onErrorRedirectResolved?.(samlErrorRedirectUrl);
 	validateSingleAssertion(SAMLResponse);
 	let parsedResponse;
 	try {
@@ -2007,7 +2052,7 @@ async function processSAMLResponse(ctx, params, options) {
 				expectedAudiences: expectedAudiences.filter(Boolean),
 				expectedRecipients: expectedRecipients.filter(Boolean)
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "invalid_saml_response",
 				error_description: error.body?.message || error.message || "Invalid SAML response"
 			}));
@@ -2018,7 +2063,7 @@ async function processSAMLResponse(ctx, params, options) {
 			expectedAudiences: expectedAudiences.filter(Boolean),
 			expectedRecipients: expectedRecipients.filter(Boolean)
 		});
-		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+		throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 			error: "invalid_saml_response",
 			error_description: "SAML response binding could not be validated"
 		}));
@@ -2039,7 +2084,7 @@ async function processSAMLResponse(ctx, params, options) {
 					inResponseTo,
 					providerId
 				});
-				throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 					error: "invalid_saml_response",
 					error_description: "Unknown or expired request ID"
 				}));
@@ -2050,14 +2095,14 @@ async function processSAMLResponse(ctx, params, options) {
 					expectedProvider: storedRequest.providerId,
 					actualProvider: providerId
 				});
-				throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+				throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 					error: "invalid_saml_response",
 					error_description: "Provider mismatch"
 				}));
 			}
 		} else if (!allowIdpInitiated) {
 			ctx.context.logger.error("SAML IdP-initiated SSO rejected: InResponseTo missing and allowIdpInitiated is false", { providerId });
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "unsolicited_response",
 				error_description: "IdP-initiated SSO not allowed"
 			}));
@@ -2085,7 +2130,7 @@ async function processSAMLResponse(ctx, params, options) {
 				issuer,
 				providerId
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "replay_detected",
 				error_description: "SAML assertion has already been used"
 			}));
@@ -2114,8 +2159,8 @@ async function processSAMLResponse(ctx, params, options) {
 		throw new APIError("BAD_REQUEST", { message: "Unable to extract user ID or email from SAML response" });
 	}
 	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
-	const callbackUrl = relayState?.callbackURL || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-	const errorUrl = relayState?.errorURL || samlRedirectUrl;
+	const callbackUrl = redirectCandidates.some(Boolean) ? samlRedirectUrl : ctx.context.baseURL;
+	const errorUrl = samlErrorRedirectUrl;
 	let result;
 	try {
 		result = await handleOAuthUserInfo(ctx, {
@@ -2187,7 +2232,7 @@ async function processSAMLResponse(ctx, params, options) {
 			expiresAt: session.expiresAt
 		}).catch((e) => ctx.context.logger.warn("Failed to create SAML session lookup record", e));
 	}
-	return getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	return samlRedirectUrl;
 }
 //#endregion
 //#region src/routes/sso.ts
@@ -2282,6 +2327,7 @@ const ssoProviderBodySchema = z.object({
 		entryPoint: z.string({}).meta({ description: "The entry point of the provider" }),
 		cert: z.string({}).meta({ description: "The certificate of the provider" }),
 		callbackUrl: z.string({}).meta({ description: "The callback URL of the provider" }),
+		idpInitiatedCallbackUrl: samlRedirectUrlSchema.meta({ description: "Fallback absolute URL or same-origin relative path for IdP-initiated SAML responses when RelayState does not contain a safe callback, including validation errors" }).optional(),
 		audience: z.string().optional(),
 		idpMetadata: z.object({
 			metadata: z.string().optional(),
@@ -2531,13 +2577,13 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if (new Set([
+		if ((/* @__PURE__ */ new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		]).has(body.providerId)) {
+		])).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
@@ -2647,6 +2693,7 @@ const registerSSOProvider = (options) => {
 					entryPoint: body.samlConfig.entryPoint,
 					cert: body.samlConfig.cert,
 					callbackUrl: body.samlConfig.callbackUrl,
+					idpInitiatedCallbackUrl: body.samlConfig.idpInitiatedCallbackUrl,
 					audience: body.samlConfig.audience,
 					idpMetadata: body.samlConfig.idpMetadata,
 					spMetadata: body.samlConfig.spMetadata,
@@ -3205,7 +3252,7 @@ const callbackSSOSAML = (options) => {
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
 			if (!(await getSessionFromCtx(ctx))?.session) throw ctx.redirect(`${errorURL}?error=invalid_request`);
 			const relayState = ctx.query?.RelayState;
-			const safeRedirectUrl = getSafeRedirectUrl(relayState, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+			const safeRedirectUrl = getSafeRedirectUrl([relayState], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 			throw ctx.redirect(safeRedirectUrl);
 		}
 		if (!ctx.body?.SAMLResponse) throw new APIError("BAD_REQUEST", { message: "SAMLResponse is required for POST requests" });
@@ -3240,12 +3287,16 @@ const acsEndpoint = (options) => {
 		const { providerId } = ctx.params;
 		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
+		let resolvedErrorRedirectUrl;
 		try {
 			const safeRedirectUrl = await processSAMLResponse(ctx, {
 				SAMLResponse: ctx.body.SAMLResponse,
 				RelayState: ctx.body.RelayState,
 				providerId,
-				currentCallbackPath
+				currentCallbackPath,
+				onErrorRedirectResolved: (url) => {
+					resolvedErrorRedirectUrl = url;
+				}
 			}, options);
 			throw ctx.redirect(safeRedirectUrl);
 		} catch (error) {
@@ -3253,8 +3304,23 @@ const acsEndpoint = (options) => {
 			if (error instanceof APIError && error.statusCode === 400) {
 				const internalCode = error.body?.code || "";
 				const errorCode = internalCode === "SAML_MULTIPLE_ASSERTIONS" ? "multiple_assertions" : internalCode === "SAML_NO_ASSERTION" ? "no_assertion" : internalCode.toLowerCase() || "saml_error";
-				const redirectUrl = getSafeRedirectUrl(ctx.body.RelayState || void 0, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
-				throw ctx.redirect(`${redirectUrl}${redirectUrl.includes("?") ? "&" : "?"}error=${encodeURIComponent(errorCode)}&error_description=${encodeURIComponent(error.message)}`);
+				let redirectUrl = resolvedErrorRedirectUrl;
+				if (!redirectUrl) {
+					let parsedSamlConfig;
+					try {
+						parsedSamlConfig = (await findSAMLProvider(providerId, options, ctx.context.adapter))?.samlConfig;
+					} catch (providerLookupError) {
+						ctx.context.logger.warn("Failed to resolve SAML provider for error redirect", {
+							providerId,
+							error: providerLookupError
+						});
+					}
+					redirectUrl = getSafeRedirectUrl(getSAMLRedirectCandidates(ctx.body.RelayState, parsedSamlConfig, options?.saml), currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+				}
+				throw ctx.redirect(buildSAMLRedirectUrl(redirectUrl, {
+					error: errorCode,
+					error_description: error.message
+				}));
 			}
 			throw error;
 		}
@@ -3283,7 +3349,7 @@ const sloEndpoint = (options) => {
 		const samlResponse = ctx.body?.SAMLResponse || ctx.query?.SAMLResponse;
 		const relayState = ctx.body?.RelayState || ctx.query?.RelayState;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
-		const safeErrorURL = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+		const safeErrorURL = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 		if (!samlRequest && !samlResponse) throw ctx.redirect(`${safeErrorURL}?error=invalid_request&error_description=missing_logout_data`);
 		const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
 		if (!provider?.samlConfig) throw APIError.from("NOT_FOUND", SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND);
@@ -3323,7 +3389,7 @@ async function handleLogoutResponse(ctx, sp, idp, relayState, providerId) {
 	}
 	deleteSessionCookie(ctx);
 	const appOrigin = new URL(ctx.context.baseURL).origin;
-	const safeRedirectUrl = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const safeRedirectUrl = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 	throw ctx.redirect(safeRedirectUrl);
 }
 async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {

package/dist/{version-CD3Z0v2C.mjs → version-DsNmK8I4.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.22";
+const PACKAGE_VERSION = "1.6.24";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/sso",
-  "version": "1.6.22",
+  "version": "1.6.24",
   "description": "SSO plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -69,16 +69,16 @@
     "body-parser": "^2.2.2",
     "express": "^5.2.1",
     "oauth2-mock-server": "^8.2.2",
-    "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.22",
-    "better-auth": "1.6.22"
+    "tsdown": "0.22.7",
+    "@better-auth/core": "1.6.24",
+    "better-auth": "1.6.24"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.7",
-    "better-auth": "^1.6.22",
-    "@better-auth/core": "^1.6.22"
+    "@better-auth/core": "^1.6.24",
+    "better-auth": "^1.6.24"
   },
   "scripts": {
     "build": "tsdown",