From 86ca6d0b1951e8624201629a8e17b9ce01ac4237 Mon Sep 17 00:00:00 2001
From: Alex Yang <himself65@outlook.com>
Date: Thu, 12 Feb 2026 18:40:51 +0800
Subject: [PATCH] fix: separate rate limit request and response handling
 (#7939)

---
 packages/better-auth/src/api/index.ts         |  5 +-
 .../better-auth/src/api/rate-limiter/index.ts | 48 +++++++++++++++----
 2 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/packages/better-auth/src/api/index.ts b/packages/better-auth/src/api/index.ts
index 812fdea670..35b6c454ff 100644
--- a/packages/better-auth/src/api/index.ts
+++ b/packages/better-auth/src/api/index.ts
@@ -12,7 +12,7 @@ import { createRouter } from "better-call";
 import type { UnionToIntersection } from "../types";
 import { isAPIError } from "../utils/is-api-error";
 import { originCheckMiddleware } from "./middlewares";
-import { onRequestRateLimit } from "./rate-limiter";
+import { onRequestRateLimit, onResponseRateLimit } from "./rate-limiter";
 import {
 	accountInfo,
 	callbackOAuth,
@@ -302,7 +302,8 @@ export const router = <Option extends BetterAuthOptions>(
 
 			return currentRequest;
 		},
-		async onResponse(res) {
+		async onResponse(res, req) {
+			await onResponseRateLimit(req, ctx);
 			for (const plugin of ctx.options.plugins || []) {
 				if (plugin.onResponse) {
 					const response = await plugin.onResponse(res, ctx);
diff --git a/packages/better-auth/src/api/rate-limiter/index.ts b/packages/better-auth/src/api/rate-limiter/index.ts
index 7b17213c41..a0a0d36585 100644
--- a/packages/better-auth/src/api/rate-limiter/index.ts
+++ b/packages/better-auth/src/api/rate-limiter/index.ts
@@ -157,17 +157,14 @@ function getRateLimitStorage(
 	return createDatabaseStorageWrapper(ctx);
 }
 
-export async function onRequestRateLimit(req: Request, ctx: AuthContext) {
-	if (!ctx.rateLimit.enabled) {
-		return;
-	}
+async function resolveRateLimitConfig(req: Request, ctx: AuthContext) {
 	const basePath = new URL(ctx.baseURL).pathname;
 	const path = normalizePathname(req.url, basePath);
 	let currentWindow = ctx.rateLimit.window;
 	let currentMax = ctx.rateLimit.max;
 	const ip = getIp(req, ctx.options);
 	if (!ip) {
-		return;
+		return null;
 	}
 	const key = createRateLimitKey(ip, path);
 	const specialRules = getDefaultSpecialRules();
@@ -214,11 +211,45 @@ export async function onRequestRateLimit(req: Request, ctx: AuthContext) {
 			}
 
 			if (resolved === false) {
-				return;
+				return null;
 			}
 		}
 	}
 
+	return { key, currentWindow, currentMax };
+}
+
+export async function onRequestRateLimit(req: Request, ctx: AuthContext) {
+	if (!ctx.rateLimit.enabled) {
+		return;
+	}
+	const config = await resolveRateLimitConfig(req, ctx);
+	if (!config) {
+		return;
+	}
+	const { key, currentWindow, currentMax } = config;
+
+	const storage = getRateLimitStorage(ctx, {
+		window: currentWindow,
+	});
+	const data = await storage.get(key);
+
+	if (data && shouldRateLimit(currentMax, currentWindow, data)) {
+		const retryAfter = getRetryAfter(data.lastRequest, currentWindow);
+		return rateLimitResponse(retryAfter);
+	}
+}
+
+export async function onResponseRateLimit(req: Request, ctx: AuthContext) {
+	if (!ctx.rateLimit.enabled) {
+		return;
+	}
+	const config = await resolveRateLimitConfig(req, ctx);
+	if (!config) {
+		return;
+	}
+	const { key, currentWindow } = config;
+
 	const storage = getRateLimitStorage(ctx, {
 		window: currentWindow,
 	});
@@ -234,10 +265,7 @@ export async function onRequestRateLimit(req: Request, ctx: AuthContext) {
 	} else {
 		const timeSinceLastRequest = now - data.lastRequest;
 
-		if (shouldRateLimit(currentMax, currentWindow, data)) {
-			const retryAfter = getRetryAfter(data.lastRequest, currentWindow);
-			return rateLimitResponse(retryAfter);
-		} else if (timeSinceLastRequest > currentWindow * 1000) {
+		if (timeSinceLastRequest > currentWindow * 1000) {
 			// Reset the count if the window has passed since the last request
 			await storage.set(
 				key,