From 5f10ed6884af889365d7f0a639fa22a25d3fa571 Mon Sep 17 00:00:00 2001 From: somuai Date: Fri, 4 Sep 2026 01:11:04 +0530 Subject: [PATCH] fix(auth): block passkey authentication and email signup when SSO is enforced - Include /sign-in/passkey, /passkey/verify-authentication, /passkey/generate-authenticate-options, and /sign-up/email in enforced SSO block - Prevents registered passkeys from bypassing enforced SSO policies --- packages/server/src/lib/auth.ts | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index 0bd5014a7..10d62a5b0 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -126,16 +126,20 @@ const createBetterAuth = () => ...(await resolveTrustedOrigins()), ].filter(Boolean); - if ( - !IS_CLOUD && - (ctx.path.startsWith("/sign-in/email") || - ctx.path.startsWith("/sign-in/social")) - ) { + const isBlockedAuthPath = + ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social") || + ctx.path.startsWith("/sign-in/passkey") || + ctx.path.startsWith("/sign-up/email") || + ctx.path.startsWith("/passkey/verify-authentication") || + ctx.path.startsWith("/passkey/generate-authenticate-options"); + + if (!IS_CLOUD && isBlockedAuthPath) { const settings = await getWebServerSettings(); if (settings?.enforceSSO) { throw new APIError("FORBIDDEN", { message: - "SSO is enforced. Direct password and social sign-in are disabled.", + "SSO is enforced. Direct password, social, and passkey sign-in are disabled.", }); } }