fix: harden identity HTTP transport

2026-07-21 23:50:41 -05:00
parent c91f0c8c6d
commit d9b73fd81a
15 changed files with 967 additions and 72 deletions
@@ -223,6 +223,16 @@ for an unrecognized origin does not prevent the server from processing the reque
 Auth's own origin/CSRF checks (below) independently protect state-changing calls regardless of
 CORS.

+> **Correction — see [ADR 0012](0012-identity-origin-csrf-protection-under-test.md).** The
+> paragraphs below describe what was verified and, honestly, not yet understood at the time this
+> ADR was accepted. ADR 0012 found the root cause of the Vitest non-reproduction described here
+> (the pinned Better Auth release silently skips its own origin/CSRF checks whenever `isTest()` is
+> true unless `advanced.disableOriginCheck` is explicitly set — Vitest's default `NODE_ENV=test`
+> triggers exactly that), fixed it by setting `advanced.disableCSRFCheck`/`disableOriginCheck`
+> explicitly to `false`, and added the automated coverage this ADR states does not exist. This
+> section is left as originally accepted, as the historical record; ADR 0012 is now authoritative
+> for this behavior.
+
 Better Auth's own CSRF/origin protections are untouched: `advanced.disableCSRFCheck` and
 `advanced.disableOriginCheck` are never set. Verified directly and repeatedly against the pinned
 release, through the real, compiled `apps/api` HTTP server (not just a direct `auth.handler()`