new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

generic-oauth/security

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Issuer validation security protection

Better Auth validates the OAuth provider's issuer to protect against mix-up attacks per RFC 9207. When an OAuth provider supports RFC 9207, it includes an iss (issuer) parameter in the authorization response. Better Auth validates this parameter against the expected issuer to ensure the response came from the intended provider.

Issuer validation behavior table

Issuer validation behavior: (1) iss matches expected - always results in Success, (2) iss doesn't match - always results in issuer_mismatch error, (3) iss missing with requireIssuerValidation false (default) - results in Success (backward compatible), (4) iss missing with requireIssuerValidation true - results in issuer_missing error.

Issuer validation recommendation

For maximum security with modern OAuth/OIDC providers (Google, Auth0, Okta, etc.), it is recommended to enable requireIssuerValidation: true.

Give your agent this brain