better-auth 1.7.25 on Node.js NPM

Important

Action required

If you want oauthProviderResourceClient(auth) to keep fetching signing keys over HTTP, set jwksUrl. (#12578)

`better-auth`

Fixed endpoint errors dropping Access-Control-Expose-Headers names set earlier by a hook or the endpoint, so cross-origin browser clients keep access to exposed headers (#12603)

For detailed changes, see CHANGELOG

Fixed OAuth provider 401 challenges to expose WWW-Authenticate to cross-origin browser clients on every endpoint, including client registration and token endpoint authentication (#12603)
Fixed DPoP requests failing with a 500 error on deployments that keep verification values only in secondary storage (#12587)
Fixed RP-initiated logout on runtimes that block requests to their own hostname by verifying id_token_hint with in-process signing keys (#12578)
Fixed introspection and revocation reporting valid JWT access tokens as inactive when two auth instances share one jwt() plugin object (#12578)
Fixed oauthProviderResourceClient(auth) token verification on runtimes that block requests to their own hostname by reading signing keys from the auth instance (#12578)

For detailed changes, see CHANGELOG

Fixed authorization URLs re-encoding query parameters already present on the provider's authorization endpoint, such as %20 becoming + (#12572)
Fixed the default in-memory DPoP replay store slowing down as request volume grows (#12586)
Fixed DPoP requests failing with a 500 error on deployments that keep verification values only in secondary storage (#12587)

For detailed changes, see CHANGELOG

Fixed DPoP requests failing with a 500 error on deployments that keep verification values only in secondary storage (#12587)

For detailed changes, see CHANGELOG

Thanks to everyone who contributed to this release:

Full changelog: v1.7.24...v1.7.25