Better Auth reflects the request Origin into Access-Control-Allow-Origin
unconditionally, bypassing the trustedOrigins config. An attacker-origin
page could XHR /api/auth/sign-in/social with credentials and read the OIDC
authorize URL + state from the response body.
- Add src/lib/auth-cors.ts: enforceAuthCors() wraps any Better Auth Response,
stripping ACAO/ACAC for untrusted origins and enforcing the allowlist for
trusted ones
- Wire enforceAuthCors() into the /api/auth/* handler in src/index.ts
- Add src/__tests__/authCors.test.ts: 6 regression tests covering trusted,
untrusted, undefined, and empty-string origins
- Update UAT_PLAYBOOK.md §4.1 with TC-API-1.29/1.30/1.31 CORS test cases
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Flea Flicker
20a0c7eb92