From 9b290270be3651b3792cc41f960b2bb417e4f7e1 Mon Sep 17 00:00:00 2001
From: Chris Arderne <chris@trigger.dev>
Date: Mon, 13 Jul 2026 10:34:58 +0100
Subject: [PATCH] fix(webapp): return 415 for invalid SSO form content types

---
 .server-changes/sso-form-content-type.md | 6 ++++++
 apps/webapp/app/routes/auth.sso.ts       | 8 ++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 .server-changes/sso-form-content-type.md

diff --git a/.server-changes/sso-form-content-type.md b/.server-changes/sso-form-content-type.md
new file mode 100644
index 00000000000..a7699a4dc41
--- /dev/null
+++ b/.server-changes/sso-form-content-type.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Return a clear client error when SSO form submissions use an unsupported content type
diff --git a/apps/webapp/app/routes/auth.sso.ts b/apps/webapp/app/routes/auth.sso.ts
index c1eb6113451..671f20d4196 100644
--- a/apps/webapp/app/routes/auth.sso.ts
+++ b/apps/webapp/app/routes/auth.sso.ts
@@ -23,6 +23,14 @@ export async function action({ request }: ActionFunctionArgs) {
     return new Response(null, { status: 405 });
   }
 
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (
+    !contentType.includes("application/x-www-form-urlencoded") &&
+    !contentType.includes("multipart/form-data")
+  ) {
+    return new Response(null, { status: 415 });
+  }
+
   const form = await request.formData();
   const rawEmail = form.get("email");
   if (typeof rawEmail !== "string" || rawEmail.trim().length === 0) {