gsadmin/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-10-20 07:31:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): block passkey authentication and email signup when SSO is enforced

Browse Source 
- Include /sign-in/passkey, /passkey/verify-authentication, /passkey/generate-authenticate-options, and /sign-up/email in enforced SSO block
- Prevents registered passkeys from bypassing enforced SSO policies
This commit is contained in:
somuai
2026-09-04 01:11:04 +05:30
parent 9568a4f9f8
commit 5f10ed6884
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/lib/auth.ts
+10 -6
View File
@@ -126,16 +126,20 @@ const createBetterAuth = () =>
...(await resolveTrustedOrigins()),
].filter(Boolean);
if (
!IS_CLOUD &&
(ctx.path.startsWith("/sign-in/email") ||
ctx.path.startsWith("/sign-in/social"))
) {
const isBlockedAuthPath =
ctx.path.startsWith("/sign-in/email") ||
ctx.path.startsWith("/sign-in/social") ||
ctx.path.startsWith("/sign-in/passkey") ||
ctx.path.startsWith("/sign-up/email") ||
ctx.path.startsWith("/passkey/verify-authentication") ||
ctx.path.startsWith("/passkey/generate-authenticate-options");
if (!IS_CLOUD && isBlockedAuthPath) {
const settings = await getWebServerSettings();
if (settings?.enforceSSO) {
throw new APIError("FORBIDDEN", {
message:
"SSO is enforced. Direct password and social sign-in are disabled.",
"SSO is enforced. Direct password, social, and passkey sign-in are disabled.",
});
}
}