fix(cookies): retry fallback name when validation fails due to stale chunks

packages/better-auth/src/cookies/index.ts

@@ -448,9 +448,9 @@ export const getCookieCache = async <
 
 	// when isSecure is unset, try both names — createCookieGetter uses the
 	// baseURL scheme, not NODE_ENV, so the prefix may differ from isProduction.
-	const [primaryName, fallbackName] =
+	const namesToTry: string[] =
 		config?.isSecure !== undefined
-			? [config.isSecure ? secureName : plainName, undefined]
+			? [config.isSecure ? secureName : plainName]
 			: isProduction
 				? [secureName, plainName]
 				: [plainName, secureName];
@@ -475,13 +475,12 @@ export const getCookieCache = async <
 		return chunks.map((c) => c.value).join("");
 	};
 
-	// Check for chunked cookies
-	let sessionData = getFromParsed(primaryName);
-	if (!sessionData && fallbackName) {
-		sessionData = getFromParsed(fallbackName);
-	}
+	const strategy = config?.strategy || "compact";
+
+	for (const name of namesToTry) {
+		const sessionData = getFromParsed(name);
+		if (!sessionData) continue;
 
-	if (sessionData) {
 		const secret = config?.secret || env.BETTER_AUTH_SECRET;
 		if (!secret) {
 			throw new BetterAuthError(
@@ -489,8 +488,6 @@ export const getCookieCache = async <
 			);
 		}
 
-		const strategy = config?.strategy || "compact";
-
 		if (strategy === "jwe") {
 			// Use JWE strategy (encrypted)
 			const payload = await symmetricDecodeJWT<S>(
@@ -516,7 +513,6 @@ export const getCookieCache = async <
 				}
 				return payload;
 			}
-			return null;
 		} else if (strategy === "jwt") {
 			// Use JWT strategy with HMAC signature (HS256), no encryption
 			const payload = await verifyJWT<S>(sessionData, secret);
@@ -538,7 +534,6 @@ export const getCookieCache = async <
 				}
 				return payload;
 			}
-			return null;
 		} else {
 			// Use compact strategy (or legacy base64-hmac)
 			const sessionDataPayload = safeJSONParse<{
@@ -546,9 +541,8 @@ export const getCookieCache = async <
 				expiresAt: number;
 				signature: string;
 			}>(binary.decode(base64Url.decode(sessionData)));
-			if (!sessionDataPayload) {
-				return null;
-			}
+			if (!sessionDataPayload) continue;
+
 			const isValid = await createHMAC("SHA-256", "base64urlnopad").verify(
 				secret,
 				JSON.stringify({
@@ -557,9 +551,7 @@ export const getCookieCache = async <
 				}),
 				sessionDataPayload.signature,
 			);
-			if (!isValid) {
-				return null;
-			}
+			if (!isValid) continue;
 
 			// Validate version if provided
 			if (config?.version && sessionDataPayload.session) {