From b839e6d6be9ee7a19272bce9ce20eb6f6afab475 Mon Sep 17 00:00:00 2001 From: somuai Date: Thu, 3 Sep 2026 16:40:21 +0530 Subject: [PATCH] fix(auth): enforce SSO on server-side sign-in endpoints Resolves #5288. - In better-auth hooks.before, reject /sign-in/email and /sign-in/social with FORBIDDEN when webServerSettings.enforceSSO is enabled - Prevents direct API password authentication when SSO enforcement is enabled --- packages/server/src/lib/auth.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts index ab52c6ca2..ad38a4ffc 100644 --- a/packages/server/src/lib/auth.ts +++ b/packages/server/src/lib/auth.ts @@ -125,6 +125,19 @@ const createBetterAuth = () => ...(ctx.context.baseURL ? [new URL(ctx.context.baseURL).origin] : []), ...(await resolveTrustedOrigins()), ].filter(Boolean); + + if ( + !IS_CLOUD && + (ctx.path.startsWith("/sign-in/email") || + ctx.path.startsWith("/sign-in/social")) + ) { + const settings = await getWebServerSettings(); + if (settings?.enforceSSO) { + throw new APIError("FORBIDDEN", { + message: "SSO is enforced. Direct password and social sign-in are disabled.", + }); + } + } }), }, emailVerification: {