From 0b82136ede6cb0fba401857a6ea0162124122ea4 Mon Sep 17 00:00:00 2001
From: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Date: Sat, 15 Mar 2025 22:31:52 +0300
Subject: [PATCH] fix: get session cookie helper should use better url
 retrieval and read config overrides (#1828)

* fix: url retreiving should use getBaseURL

* fix: session cookie getter issue with custom config

* chore: remove log
---
 .../better-auth/src/cookies/cookies.test.ts   | 93 ++++++++++++++++++-
 packages/better-auth/src/cookies/index.ts     | 26 ++++--
 2 files changed, 109 insertions(+), 10 deletions(-)

diff --git a/packages/better-auth/src/cookies/cookies.test.ts b/packages/better-auth/src/cookies/cookies.test.ts
index 4481f61393..1b54513574 100644
--- a/packages/better-auth/src/cookies/cookies.test.ts
+++ b/packages/better-auth/src/cookies/cookies.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { getTestInstance } from "../test-utils/test-instance";
-import { getCookies } from "../cookies";
+import { getCookies, getSessionCookie } from "../cookies";
 import type { BetterAuthOptions } from "../types/options";
 
 describe("cookies", async () => {
@@ -151,3 +151,94 @@ describe("cookie configuration", () => {
 		expect(cookies.sessionData.options.domain).toBe("example.com");
 	});
 });
+
+describe("getSessionCookie", async () => {
+	it("should return the correct session cookie", async () => {
+		const { client, testUser, signInWithTestUser } = await getTestInstance();
+		const { headers } = await signInWithTestUser();
+		const request = new Request("http://localhost:3000/api/auth/session", {
+			headers,
+		});
+		const cookies = getSessionCookie(request);
+		expect(cookies).not.toBeNull();
+		expect(cookies).toBeDefined();
+	});
+
+	it("should return the correct session cookie on production", async () => {
+		const { client, testUser, cookieSetter } = await getTestInstance({
+			baseURL: "https://example.com",
+		});
+		const headers = new Headers();
+		await client.signIn.email(
+			{
+				email: testUser.email,
+				password: testUser.password,
+			},
+			{
+				onSuccess: cookieSetter(headers),
+			},
+		);
+		const request = new Request("https://example.com/api/auth/session", {
+			headers,
+		});
+		const cookies = getSessionCookie(request);
+		expect(cookies).not.toBeNull();
+		expect(cookies).toBeDefined();
+	});
+
+	it("should allow override cookie prefix", async () => {
+		const { client, testUser, cookieSetter } = await getTestInstance({
+			advanced: {
+				useSecureCookies: true,
+				cookiePrefix: "test-prefix",
+			},
+		});
+		const headers = new Headers();
+		await client.signIn.email(
+			{
+				email: testUser.email,
+				password: testUser.password,
+			},
+			{ onSuccess: cookieSetter(headers) },
+		);
+		const request = new Request("https://example.com/api/auth/session", {
+			headers,
+		});
+		const cookies = getSessionCookie(request, {
+			cookiePrefix: "test-prefix",
+		});
+		expect(cookies).not.toBeNull();
+	});
+
+	it("should allow override cookie name", async () => {
+		const { client, testUser, cookieSetter } = await getTestInstance({
+			advanced: {
+				useSecureCookies: true,
+				cookiePrefix: "test",
+				cookies: {
+					session_token: {
+						name: "test-session-token",
+					},
+				},
+			},
+		});
+		const headers = new Headers();
+		await client.signIn.email(
+			{
+				email: testUser.email,
+				password: testUser.password,
+			},
+			{
+				onSuccess: cookieSetter(headers),
+			},
+		);
+		const request = new Request("https://example.com/api/auth/session", {
+			headers,
+		});
+		const cookies = getSessionCookie(request, {
+			cookieName: "session-token",
+			cookiePrefix: "test",
+		});
+		expect(cookies).not.toBeNull();
+	});
+});
diff --git a/packages/better-auth/src/cookies/index.ts b/packages/better-auth/src/cookies/index.ts
index 0f6d1d1894..af24cb44d3 100644
--- a/packages/better-auth/src/cookies/index.ts
+++ b/packages/better-auth/src/cookies/index.ts
@@ -9,6 +9,7 @@ import { base64Url } from "@better-auth/utils/base64";
 import { createTime } from "../utils/time";
 import { createHMAC } from "@better-auth/utils/hmac";
 import { safeJSONParse } from "../utils/json";
+import { getBaseURL } from "../utils/url";
 
 export function createCookieGetter(options: BetterAuthOptions) {
 	const secure =
@@ -239,26 +240,33 @@ export const getSessionCookie = (
 		cookiePrefix?: string;
 		cookieName?: string;
 		useSecureCookies?: boolean;
+		path?: string;
 	},
 ) => {
+	if (config?.cookiePrefix) {
+		if (config.cookieName) {
+			config.cookiePrefix = `${config.cookiePrefix}-`;
+		} else {
+			config.cookiePrefix = `${config.cookiePrefix}.`;
+		}
+	}
 	const headers = request instanceof Headers ? request : request.headers;
+	const req = request instanceof Request ? request : undefined;
+	const url = getBaseURL(req?.url, config?.path, req);
 	const cookies = headers.get("cookie");
 	if (!cookies) {
 		return null;
 	}
 	const {
 		cookieName = "session_token",
-		cookiePrefix = "better-auth",
-		useSecureCookies = (request instanceof Request &&
-			isProduction &&
-			request.url.startsWith("https://")) ||
-			(request instanceof Request && request.url.startsWith("https://")
-				? true
-				: false),
+		cookiePrefix = "better-auth.",
+		useSecureCookies = isProduction || url?.startsWith("https://")
+			? true
+			: false,
 	} = config || {};
 	const name = useSecureCookies
-		? `__Secure-${cookiePrefix}.${cookieName}`
-		: `${cookiePrefix}.${cookieName}`;
+		? `__Secure-${cookiePrefix}${cookieName}`
+		: `${cookiePrefix}${cookieName}`;
 	const parsedCookie = parseCookies(cookies);
 	const sessionToken = parsedCookie.get(name);
 	if (sessionToken) {