fix(sso): prefer UserInfo endpoint over ID token and map sub claim correctly by himself65 · Pull Request #8276 · better-auth/better-auth

himself65 · 2026-03-02T06:23:48Z

Summary

The UserInfo endpoint fallback path was checking userInfo.id, but standard OIDC providers return sub (not id) as the subject identifier per OIDC spec Section 5.1
Applied the same claim mapping logic (sub→id, picture→image, email_verified→emailVerified, extraFields) to the UserInfo endpoint path that already existed for the ID token path
Updated the betterFetch generic type to Record<string, unknown> to accurately reflect raw OIDC UserInfo responses

Test plan

Verify SSO login works with an OIDC provider that does not include user claims in the ID token (e.g., Tinyauth)
Verify SSO login still works with providers that include claims in the ID token (existing behavior unchanged)
All existing SSO tests pass (pnpm vitest packages/sso/src --run)

The UserInfo endpoint fallback path was assigning the raw response directly to userInfo and then checking for userInfo.id, which doesn't exist in standard OIDC responses. Per the OIDC spec (Section 5.1), providers use the sub claim as the subject identifier. Apply the same mapping logic (sub→id, picture→image, email_verified→emailVerified, extraFields) to the UserInfo endpoint path that already existed for the ID token path. Fixes #8269

vercel · 2026-03-02T06:23:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
better-auth-demo	Ignored		Mar 2, 2026 6:59am
better-auth-docs	Skipped		Mar 2, 2026 6:59am

pkg-pr-new · 2026-03-02T06:25:04Z

Open in StackBlitz

@better-auth/api-key

npm i https://pkg.pr.new/@better-auth/api-key@8276

better-auth

npm i https://pkg.pr.new/better-auth@8276

auth

npm i https://pkg.pr.new/auth@8276

@better-auth/core

npm i https://pkg.pr.new/@better-auth/core@8276

@better-auth/drizzle-adapter

npm i https://pkg.pr.new/@better-auth/drizzle-adapter@8276

@better-auth/electron

npm i https://pkg.pr.new/@better-auth/electron@8276

@better-auth/expo

npm i https://pkg.pr.new/@better-auth/expo@8276

@better-auth/i18n

npm i https://pkg.pr.new/@better-auth/i18n@8276

@better-auth/kysely-adapter

npm i https://pkg.pr.new/@better-auth/kysely-adapter@8276

@better-auth/memory-adapter

npm i https://pkg.pr.new/@better-auth/memory-adapter@8276

@better-auth/mongo-adapter

npm i https://pkg.pr.new/@better-auth/mongo-adapter@8276

@better-auth/oauth-provider

npm i https://pkg.pr.new/@better-auth/oauth-provider@8276

@better-auth/passkey

npm i https://pkg.pr.new/@better-auth/passkey@8276

@better-auth/prisma-adapter

npm i https://pkg.pr.new/@better-auth/prisma-adapter@8276

@better-auth/redis-storage

npm i https://pkg.pr.new/@better-auth/redis-storage@8276

@better-auth/scim

npm i https://pkg.pr.new/@better-auth/scim@8276

@better-auth/sso

npm i https://pkg.pr.new/@better-auth/sso@8276

@better-auth/stripe

npm i https://pkg.pr.new/@better-auth/stripe@8276

@better-auth/telemetry

npm i https://pkg.pr.new/@better-auth/telemetry@8276

@better-auth/test-utils

npm i https://pkg.pr.new/@better-auth/test-utils@8276

commit: f56c5ed

cubic-dev-ai

No issues found across 1 file

Copilot

Pull request overview

This PR fixes an OIDC compliance bug in the SSO module where the UserInfo endpoint fallback path was looking for an id claim (non-standard) instead of sub (OIDC spec Section 5.1 standard). The fix applies the same claim mapping logic that already existed for the ID token path to the UserInfo endpoint path as well, enabling correct sign-in with providers like Tinyauth that don't include user claims in the ID token.

Changes:

Applied full claim mapping logic (sub→id, picture→image, email_verified→emailVerified, extraFields) to the UserInfo endpoint fallback path, consistent with the existing ID token path.
Changed the betterFetch generic type from an explicit fixed-shape interface to Record<string, unknown> to accurately reflect raw OIDC UserInfo responses.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/sso/src/routes/sso.ts

steveiliop56 · 2026-03-02T06:39:38Z

@himself65 maybe you should also prioritize the user-info endpoint instead of the ID token since it tends to be more reliable.

Regression test for #8269: verifies that SSO login succeeds when the OIDC provider returns no ID token (access-token-only flow) and the UserInfo endpoint returns the standard sub claim instead of id.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

When a userInfoEndpoint is configured, use it as the primary source of user claims rather than falling back to it only when there is no ID token. The UserInfo endpoint is always up-to-date and is the authoritative OIDC source for user attributes. Fallback order is now: UserInfo endpoint → ID token → error.

…rrectly (#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…rrectly (better-auth#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 2, 2026 06:23

himself65 requested a review from Bekacru as a code owner March 2, 2026 06:23

Copilot started reviewing on behalf of himself65 March 2, 2026 06:24 View session

cubic-dev-ai bot reviewed Mar 2, 2026

View reviewed changes

Copilot AI reviewed Mar 2, 2026

View reviewed changes

packages/sso/src/routes/sso.ts Outdated Show resolved Hide resolved

packages/sso/src/routes/sso.ts Outdated Show resolved Hide resolved

test(sso): add test for UserInfo endpoint sub claim mapping

5155c5d

Regression test for #8269: verifies that SSO login succeeds when the OIDC provider returns no ID token (access-token-only flow) and the UserInfo endpoint returns the standard sub claim instead of id.

vercel bot temporarily deployed to Preview – better-auth-docs March 2, 2026 06:48 Inactive

Update sso.ts

9670704

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

vercel bot temporarily deployed to Preview – better-auth-docs March 2, 2026 06:53 Inactive

lint fix

8e1cd01

vercel bot temporarily deployed to Preview – better-auth-docs March 2, 2026 06:53 Inactive

vercel bot temporarily deployed to Preview – better-auth-docs March 2, 2026 06:59 Inactive

himself65 changed the title ~~fix(sso): use sub claim from UserInfo endpoint for OIDC compliance~~ fix(sso): prefer UserInfo endpoint over ID token and map sub claim correctly Mar 2, 2026

himself65 added this pull request to the merge queue Mar 2, 2026

Merged via the queue into canary with commit e32bad1 Mar 2, 2026
23 checks passed

himself65 added a commit that referenced this pull request Mar 3, 2026

fix(sso): prefer UserInfo endpoint over ID token and map sub claim co…

0176bd9

…rrectly (#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

himself65 mentioned this pull request Mar 3, 2026

fix: cherry-pick bug fixes for v1.5.2 #8324

Merged

5 tasks

himself65 added a commit that referenced this pull request Mar 3, 2026

fix(sso): prefer UserInfo endpoint over ID token and map sub claim co…

f88bcd7

…rrectly (#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rae-fcm pushed a commit to FullCodeMedical/better-auth that referenced this pull request Mar 9, 2026

fix(sso): prefer UserInfo endpoint over ID token and map sub claim co…

7a53f84

…rrectly (better-auth#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rae-fcm pushed a commit to FullCodeMedical/better-auth that referenced this pull request Mar 10, 2026

fix(sso): prefer UserInfo endpoint over ID token and map sub claim co…

9f12efe

…rrectly (better-auth#8276) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

better-auth locked as resolved and limited conversation to collaborators Mar 31, 2026

bytaesu added the locked Locked conversations after being closed for 7 days label Mar 31, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(sso): prefer UserInfo endpoint over ID token and map sub claim correctly#8276

fix(sso): prefer UserInfo endpoint over ID token and map sub claim correctly#8276
himself65 merged 5 commits intocanaryfrom
fix/sso-userinfo-sub-claim

himself65 commented Mar 2, 2026

Uh oh!

vercel bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

steveiliop56 commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

himself65 commented Mar 2, 2026

Summary

Test plan

Uh oh!

vercel bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

steveiliop56 commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel bot commented Mar 2, 2026 •

edited

Loading

pkg-pr-new bot commented Mar 2, 2026 •

edited

Loading