auth: login page resumes the OAuth authorize flow after sign-in

Better Auth redirects to the login page with the original signed authorize params; hand them back to /oauth2/authorize as the post-sign-in callback so a code is issued (was defaulting to '/', producing a blank page).
2026-07-05 22:39:13 -04:00
parent 1a52fba596
commit 4e49632e23
1 changed files with 7 additions and 4 deletions
@@ -12,9 +12,12 @@ import { auth } from "./auth.js";
 const PORT = Number(process.env.PORT ?? 8080);
 const handler = toNodeHandler(auth);

-function loginPage(params: URLSearchParams): string {
-  // Preserve wherever the OAuth flow wants to return to after login.
-  const cb = params.get("callbackURL") || params.get("redirect") || "/";
+function loginPage(rawSearch: string): string {
+  // Better Auth's oauth-provider redirects here with the original, signed
+  // authorize params in the query. After sign-in we must hand them back to the
+  // authorize endpoint verbatim so it resumes and issues the code. If there's no
+  // OAuth context (a stray visit), fall back to the portal.
+  const cb = rawSearch ? "/api/auth/oauth2/authorize" + rawSearch : "/portal";
  const social = (provider: string, label: string) => `
    <button data-provider="${provider}" class="btn">${label}</button>`;
  return `<!doctype html>
@@ -58,7 +61,7 @@ const server = createServer((req, res) => {
  }
  if (url.pathname === "/login" && req.method === "GET") {
    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    res.end(loginPage(url.searchParams));
+    res.end(loginPage(url.search));
    return;
  }
  // Everything else -> Better Auth (async handler).