From b839e6d6be9ee7a19272bce9ce20eb6f6afab475 Mon Sep 17 00:00:00 2001 From: somuai Date: Thu, 3 Sep 2026 16:40:21 +0530 Subject: [PATCH 1/3] fix(auth): enforce SSO on server-side sign-in endpoints Resolves #5288. - In better-auth hooks.before, reject /sign-in/email and /sign-in/social with FORBIDDEN when webServerSettings.enforceSSO is enabled - Prevents direct API password authentication when SSO enforcement is enabled --- packages/server/src/lib/auth.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index ab52c6ca2..ad38a4ffc 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -125,6 +125,19 @@ const createBetterAuth = () => ...(ctx.context.baseURL ? [new URL(ctx.context.baseURL).origin] : []), ...(await resolveTrustedOrigins()), ].filter(Boolean); + + if ( + !IS_CLOUD && + (ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social")) + ) { + const settings = await getWebServerSettings(); + if (settings?.enforceSSO) { + throw new APIError("FORBIDDEN", { + message: "SSO is enforced. Direct password and social sign-in are disabled.", + }); + } + } }), }, emailVerification: { From 9568a4f9f8f5541479d9be62d9edc52716756032 Mon Sep 17 00:00:00 2001 From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com> Date: Thu, 3 Sep 2026 11:10:44 +0000 Subject: [PATCH 2/3] [autofix.ci] apply automated fixes --- packages/server/src/lib/auth.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index ad38a4ffc..0bd5014a7 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -134,7 +134,8 @@ const createBetterAuth = () => const settings = await getWebServerSettings(); if (settings?.enforceSSO) { throw new APIError("FORBIDDEN", { - message: "SSO is enforced. Direct password and social sign-in are disabled.", + message: + "SSO is enforced. Direct password and social sign-in are disabled.", }); } } From 5f10ed6884af889365d7f0a639fa22a25d3fa571 Mon Sep 17 00:00:00 2001 From: somuai Date: Fri, 4 Sep 2026 01:11:04 +0530 Subject: [PATCH 3/3] fix(auth): block passkey authentication and email signup when SSO is enforced - Include /sign-in/passkey, /passkey/verify-authentication, /passkey/generate-authenticate-options, and /sign-up/email in enforced SSO block - Prevents registered passkeys from bypassing enforced SSO policies --- packages/server/src/lib/auth.ts | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index 0bd5014a7..10d62a5b0 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -126,16 +126,20 @@ const createBetterAuth = () => ...(await resolveTrustedOrigins()), ].filter(Boolean); - if ( - !IS_CLOUD && - (ctx.path.startsWith("/sign-in/email") || - ctx.path.startsWith("/sign-in/social")) - ) { + const isBlockedAuthPath = + ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social") || + ctx.path.startsWith("/sign-in/passkey") || + ctx.path.startsWith("/sign-up/email") || + ctx.path.startsWith("/passkey/verify-authentication") || + ctx.path.startsWith("/passkey/generate-authenticate-options"); + + if (!IS_CLOUD && isBlockedAuthPath) { const settings = await getWebServerSettings(); if (settings?.enforceSSO) { throw new APIError("FORBIDDEN", { message: - "SSO is enforced. Direct password and social sign-in are disabled.", + "SSO is enforced. Direct password, social, and passkey sign-in are disabled.", }); } }