groombook/api
13
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(GRO-2586): enforce trusted-origins allowlist on Better Auth CORS responses #219

Merged
Flea Flicker merged 1 commits from feature/GRO-2586-cors-origin-reflection into dev 2026-06-26 13:36:00 +00:00
Conversation 0 Commits 1 Files Changed 4
+89 -2

1 Commits

Author SHA1 Message Date
Flea Flicker 20a0c7eb92 fix(GRO-2586): enforce trusted-origins allowlist on Better Auth CORS responses
CI / Test (pull_request) Successful in 28s
Details
CI / Lint & Typecheck (pull_request) Successful in 33s
Details
CI / Build & Push Docker Images (pull_request) Successful in 1m29s
Details 
Better Auth reflects the request Origin into Access-Control-Allow-Origin
unconditionally, bypassing the trustedOrigins config. An attacker-origin
page could XHR /api/auth/sign-in/social with credentials and read the OIDC
authorize URL + state from the response body.

- Add src/lib/auth-cors.ts: enforceAuthCors() wraps any Better Auth Response,
  stripping ACAO/ACAC for untrusted origins and enforcing the allowlist for
  trusted ones
- Wire enforceAuthCors() into the /api/auth/* handler in src/index.ts
- Add src/__tests__/authCors.test.ts: 6 regression tests covering trusted,
  untrusted, undefined, and empty-string origins
- Update UAT_PLAYBOOK.md §4.1 with TC-API-1.29/1.30/1.31 CORS test cases

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-06-26 13:29:56 +00:00