fix(generic-oauth): support symmetric ID token verification by jhapriyavart10 · Pull Request #11237 · better-auth/better-auth

jhapriyavart10 · 2026-09-10T05:48:13Z

Summary

When configuring an OIDC provider with discoveryUrl, genericOAuth currently binds ID-token verification strictly to createRemoteJWKSet(jwksUrl). For identity providers that issue symmetrically signed ID tokens (e.g. HS256, HS384, HS512), verification unconditionally fails with JWKSNoMatchingKey because OIDC Discovery §3 specifies that symmetric keys must not be published in the public JWKS.

Root Cause

genericOAuth's discovery initialization unconditionally assigns idTokenConfig.jwks = createRemoteJWKSet(jwksUrl) whenever discovered.jwks_uri and discovered.issuer are present, without inspecting the token's algorithm header at verification time.

Fix

Wrap remoteJWKS in an algorithm-aware JWTVerifyGetKey resolver.
For exact HMAC algorithms (HS256, HS384, HS512), verify using the pre-encoded bytes of the configured clientSecret per OIDC Core 1.0 §3.1.3.7.
For asymmetric algorithms, continue delegating directly to remoteJWKS.
Preserve all existing issuer, audience, nonce, and algorithm restriction checks.
If clientSecret is absent or empty, HMAC verification safely fails closed.

Tests

Added regression tests under describe("HS256 discovery verification") in packages/better-auth/src/plugins/generic-oauth/generic-oauth.test.ts:

Validates authentic HS256 ID-token verification across both OAuth redirect flow (with nonce binding) and direct client sign-in.
Validates rejection when signed with an incorrect secret.
Validates algorithm enforcement (rejecting HS256 tokens when discovery specifies only RS256).
Full generic-oauth suite passes (130/130).
pnpm typecheck passes with 0 errors.

Closes #11121

Summary by cubic

Fixes generic OAuth ID token verification for providers that issue symmetric (HS256/HS384/HS512) tokens. Verification previously always used the remote JWKS, which per OIDC Discovery doesn't include symmetric keys, so these tokens failed with JWKSNoMatchingKey. Now HMAC tokens are verified against the pre-encoded clientSecret, but only when the token's algorithm is advertised in the discovery metadata; asymmetric tokens keep using the JWKS, and verification fails closed if clientSecret is missing or the algorithm isn't advertised.

Tests

Added regression tests for valid HS256 tokens, invalid-secret rejection, missing/empty-secret rejection, and enforced algorithm restrictions from discovery, including confirmation that JWKS isn't requested when verification fails closed.

^{Written for commit be89cec. Summary will update on new commits.}

vercel · 2026-09-10T05:48:20Z

@jhapriyavart10 is attempting to deploy a commit to the better-auth Team on Vercel.

A member of the Team first needs to authorize it.

greptile-apps · 2026-09-10T05:51:17Z

Greptile Summary

The PR adds algorithm-aware generic OAuth ID-token verification, using the configured client secret only for explicitly advertised HMAC algorithms while retaining remote JWKS verification for asymmetric tokens.

Supports HS256, HS384, and HS512 ID tokens from discovery-based providers.
Fails closed when the HMAC algorithm is not advertised or the client secret is missing or empty.
Adds coverage for redirect and direct sign-in flows, invalid secrets, algorithm restrictions, and missing configuration.
The changes since the previous review add assertions confirming rejected HMAC tokens do not fall back to the public JWKS endpoint.

Confidence Score: 5/5

The PR appears safe to merge, with the previous algorithm-advertisement issue resolved and no new actionable failures identified.

HMAC verification now requires an exact algorithm advertised by discovery metadata and a non-empty configured client secret; otherwise it rejects before accessing the remote JWKS. The previous finding was manually resolved, and the current implementation and tests address its fail-closed requirement.

_{Reviews (3): Last reviewed commit: "test(generic-oauth): verify HMAC fail-cl..." | Re-trigger Greptile}

Copilot

🟡 Changes recommended

The HS* key resolver currently falls back to remote JWKS when clientSecret is missing/empty, which can violate the “fail closed” expectation and may weaken verification for misconfigured providers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the generic-oauth plugin’s OIDC discovery-based ID token verification so that symmetric ID tokens (HS256/HS384/HS512) can be verified using the configured clientSecret, while asymmetric algorithms continue to use the remote JWKS from discovery metadata—addressing failures like JWKSNoMatchingKey for providers that correctly omit symmetric keys from public JWKS.

Changes:

Wraps the discovery JWKS resolver with an alg-aware key resolver that returns clientSecret bytes for HS* algorithms.
Adds regression tests covering HS256 verification for both redirect flow (nonce-bound) and direct client idToken sign-in, plus negative cases.
Adds a changeset documenting the patch behavior change for better-auth.

File summaries

File	Description
packages/better-auth/src/plugins/generic-oauth/index.ts	Makes ID-token key resolution algorithm-aware, using `clientSecret` for HS* and remote JWKS for asymmetric algorithms.
packages/better-auth/src/plugins/generic-oauth/generic-oauth.test.ts	Adds HS256 discovery verification regression tests (happy path + rejection cases).
.changeset/generic-oauth-hs256-id-token.md	Publishes a patch changeset describing the new HS* discovery verification behavior.

Review details

Files reviewed: 3/3 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+								jwks: async (protectedHeader, token) => {
+									if (
+										protectedHeader.alg === "HS256" ||
+										protectedHeader.alg === "HS384" ||
+										protectedHeader.alg === "HS512"
+									) {
+										if (secretBytes) {
+											return secretBytes;
+										}
+									}
+									return remoteJWKS(protectedHeader, token);
+								},


cubic-dev-ai

All reported issues were addressed across 3 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

fix(generic-oauth): support symmetric ID token verification

54af291

jhapriyavart10 requested a review from a team as a code owner September 10, 2026 05:48

Copilot AI lite review requested due to automatic review settings September 10, 2026 05:48

jhapriyavart10 requested a review from a team as a code owner September 10, 2026 05:48

jhapriyavart10 requested review from gustavovalverde and removed request for a team September 10, 2026 05:48

better-release Bot added the oauth Social providers, OAuth flows, generic-oauth, oauth-proxy label Sep 10, 2026

Copilot started reviewing on behalf of jhapriyavart10 September 10, 2026 05:48 View session

greptile-apps Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread packages/better-auth/src/plugins/generic-oauth/index.ts

Copilot AI reviewed Sep 10, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread packages/better-auth/src/plugins/generic-oauth/index.ts Outdated

Comment thread packages/better-auth/src/plugins/generic-oauth/index.ts Outdated

fix(generic-oauth): restrict symmetric ID token verification

ceaa939

cubic-dev-ai Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread packages/better-auth/src/plugins/generic-oauth/generic-oauth.test.ts

test(generic-oauth): verify HMAC fail-closed JWKS behavior

be89cec

Navigation Menu

Uh oh!

Uh oh!

fix(generic-oauth): support symmetric ID token verification - #11237

fix(generic-oauth): support symmetric ID token verification#11237
jhapriyavart10 wants to merge 3 commits into
better-auth:mainfrom
jhapriyavart10:fix/generic-oauth-hs256-id-token

jhapriyavart10 commented Sep 10, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

vercel Bot commented Sep 10, 2026

Uh oh!

greptile-apps Bot commented Sep 10, 2026 •

edited

Loading

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

jhapriyavart10 commented Sep 10, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Fix

Tests

Summary by cubic

Uh oh!

vercel Bot commented Sep 10, 2026

Uh oh!

greptile-apps Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jhapriyavart10 commented Sep 10, 2026 •

edited by cubic-dev-ai Bot

Loading

greptile-apps Bot commented Sep 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading