LukeParke/better-auth
1
0
Fork 0
mirror of https://github.com/LukeHagar/better-auth.git synced 2025-12-10 04:19:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: assert state is short enough to be stored in cookie

Browse Source
This commit is contained in:
Bereket Engida
2024-10-15 06:16:09 +03:00
parent 58b7e3b521
commit 0f21842aa2
4 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
demo/nextjs/components/sign-in.tsx
View File

@@ -124,7 +124,6 @@ export default function SignIn() {
onClick={async () => { onClick={async () => {
await signIn.social({ await signIn.social({
provider: "discord", provider: "discord",
callbackURL: "/dashboard",
}); });
}} }}
> >

3
packages/better-auth/src/api/routes/sign-in.ts
View File

@@ -59,8 +59,7 @@ export const signInOAuth = createAuthEndpoint(
: `${currentURL?.origin}${c.body.callbackURL || ""}`; : `${currentURL?.origin}${c.body.callbackURL || ""}`;
const state = generateState( const state = generateState(
callbackURL || currentURL?.origin || c.context.baseURL, callbackURL || currentURL?.origin || c.context.options.baseURL,
c.query?.currentURL,
); );
await c.setSignedCookie( await c.setSignedCookie(
cookie.state.name, cookie.state.name,

3
packages/better-auth/src/plugins/generic-oauth/index.ts
View File

@@ -204,8 +204,7 @@ export const genericOAuth = (options: GenericOAuthOptions) => {
? ctx.body.callbackURL ? ctx.body.callbackURL
: `${currentURL?.origin}${ctx.body.callbackURL || ""}`; : `${currentURL?.origin}${ctx.body.callbackURL || ""}`;
const state = generateState( const state = generateState(
callbackURL || currentURL?.origin || ctx.context.baseURL, callbackURL || currentURL?.origin || ctx.context.options.baseURL,
ctx.query?.currentURL,
); );
const cookie = ctx.context.authCookies; const cookie = ctx.context.authCookies;
await ctx.setSignedCookie( await ctx.setSignedCookie(

9
packages/better-auth/src/utils/state.ts
View File

@@ -1,13 +1,18 @@
import { generateState as generateStateOAuth } from "oslo/oauth2"; import { generateState as generateStateOAuth } from "oslo/oauth2";
import { z } from "zod"; import { z } from "zod";
import { BetterAuthError } from "../error/better-auth-error";
export function generateState(callbackURL?: string, currentURL?: string) { export function generateState(callbackURL?: string) {
const code = generateStateOAuth(); const code = generateStateOAuth();
const state = JSON.stringify({ const state = JSON.stringify({
code, code,
callbackURL, callbackURL,
currentURL,
}); });
if (state.length > 4000) {
throw new BetterAuthError(
"State is too long to be safely stored in a cookie. Make sure the callbackURL is not too long.",
);
}
return state; return state;
} }