oauth-provider: well-known endpoints should be mountable at origin root
🔌Plugin
The
Per RFC 8414 Section 3 and OpenID Connect Discovery 1.0 Section 4, these endpoints must be located at the origin root when the issuer has no path component:
I created this issue with more details: https://github.com/better-auth/better-auth/issues/7453
oauth-provider/.well-known/oauth-authorization-server/.well-known/openid-configuration/api/auth/.well-known/openid-configurationPer RFC 8414 Section 3 and OpenID Connect Discovery 1.0 Section 4, these endpoints must be located at the origin root when the issuer has no path component:
"Authorization servers supporting metadata MUST make a JSON document containing metadata [...] available at a path formed by inserting a well-known URI string into the authorization server's issuer identifier between the host component and the path component, if any."
— RFC 8414 Section 3
"OpenID Providers supporting Discovery MUST make a JSON document available at the path formed by concatenating the stringto the Issuer."/.well-known/openid-configuration
— OpenID Connect Discovery 1.0 Section 4
I created this issue with more details: https://github.com/better-auth/better-auth/issues/7453
GitHub
The oauth-provider plugin mounts /.well-known/oauth-authorization-server and /.well-known/openid-configuration endpoints under the base path (e.g., /api/auth/.well-known/openid-configuration). Per ...
IETF Datatracker
This specification defines a metadata format that an OAuth 2.0 client can use to obtain the information needed to interact with an OAuth 2.0 authorization server, including its endpoint locations and authorization server capabilities.
OpenID Connect Discovery 1.0 incorporating errata set 2
Was this page helpful?
