v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.betterauth.trusted-origins-wildcard

A fully-permissive wildcard appears in better-auth's trustedOrigins.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

trustedOrigins is better-auth's origin allow-list for CSRF and callback protection. An entry of "*", "**", or a protocol-only wildcard like "https://*" / "*://*" matches EVERY host, so any website can drive authenticated cross-origin requests and receive OAuth callbacks. This defeats the origin check entirely (CWE-942 / CWE-352).

List the exact origins you trust instead: trustedOrigins: ["https://app.example.com"]. A scoped subdomain wildcard ("https://*.example.com") is fine; a bare or protocol-only * is not.

VULNERABLE
vulnerable.ts
import { betterAuth } from "better-auth";

// A fully-permissive wildcard in trustedOrigins disables better-auth's origin
// allow-list: any site can drive authenticated cross-origin requests (CSRF).
// ruleid: auth.betterauth.trusted-origins-wildcard
export const auth = betterAuth({
  trustedOrigins: ["*"],
});

// Protocol-only wildcards are just as permissive (match every host).
// ruleid: auth.betterauth.trusted-origins-wildcard
export const authHttps = betterAuth({
  trustedOrigins: ["https://app.example.com", "https://*"],
});
SAFE
safe.ts
import { betterAuth } from "better-auth";

// Explicit origins, and a scoped subdomain wildcard, are legitimate and
// documented better-auth usage — they must NOT fire.
export const auth = betterAuth({
  trustedOrigins: [
    "https://app.example.com",
    "https://admin.example.com",
    "https://*.example.com",
  ],
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.betterauth.trusted-origins-wildcard -- <reason>

References

https://www.better-auth.com/docs/reference/security ↗https://cwe.mitre.org/data/definitions/942.html ↗