Skip to content

fix: resolve /api/auth/providers HTTP 404 by adding pass-through in Better Auth wildcard #1442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaypatrick merged 3 commits into from
Mar 28, 2026
Merged

fix: resolve /api/auth/providers HTTP 404 by adding pass-through in Better Auth wildcard #1442

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
48d3153
Initial plan
Copilot Mar 28, 2026
1d9093a
fix: move /api/auth/providers route before Better Auth wildcard to fi…
Copilot Mar 28, 2026
e491744
fix: restore /api/auth/providers to pre-auth section, add pass-throug…
Copilot Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion worker/hono-app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,7 +353,15 @@ app.use('*', async (c, next) => {
// middleware to avoid interfering with Better Auth's response handling. Better Auth
// returns responses directly without calling next(), and applying compression/logging
// middleware before this handler can cause response stream conflicts.
app.on(['POST', 'GET'], '/api/auth/*', async (c) => {
//
// NOTE: /api/auth/providers is NOT a Better Auth route — it is a custom public
// endpoint registered in the pre-auth meta section (after CORS + rate-limiting).
// This handler explicitly passes through for that path so the specific handler
// receives full middleware coverage (CORS headers, anonymous-tier rate limiting).
app.on(['POST', 'GET'], '/api/auth/*', async (c, next) => {
// Pass through for custom endpoint — let it reach its registered handler with
// full CORS and rate-limiting middleware applied.
if (c.req.path === '/api/auth/providers') return next();
Comment on lines +361 to +364
Copy link

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No regression test covers the new pass-through behavior for /api/auth/providers. Since this endpoint was previously broken by the /api/auth/* wildcard routing order, please add a unit test (e.g., in worker/hono-app.test.ts) that asserts GET /api/auth/providers is not 404 and that it receives expected middleware effects (at least CORS header for an allowed Origin, and/or anonymous-tier rate limiting).

Copilot uses AI. Check for mistakes.
if (!c.env.BETTER_AUTH_SECRET) return c.notFound();
if (!c.env.HYPERDRIVE) {
// Misconfigured deployment: Hyperdrive (Neon PostgreSQL) binding is missing.
Expand Down Expand Up @@ -632,6 +640,8 @@ app.get('/api/deployments/*', handleApiMeta);
app.get('/api/turnstile-config', handleApiMeta);
app.get('/api/sentry-config', handleApiMeta);
// Public: returns which auth providers are active — used by frontend to conditionally render social login buttons.
// Registered here (after CORS + rate-limiting middleware) so it receives full middleware coverage.
// The Better Auth /api/auth/* wildcard explicitly passes through for this path.
app.get('/api/auth/providers', (c) => handleAuthProviders(c.req.raw, c.env));

// ============================================================================
Expand Down
Loading