From 9228c9e113205ecb03d565d7294f0bbc5bb4a9cc Mon Sep 17 00:00:00 2001
From: Bereket Engida <Bekacru@gmail.com>
Date: Wed, 3 Dec 2025 20:38:09 -0800
Subject: [PATCH] fix: pathname should be normalized when basePath is set to
 root

---
 packages/better-auth/src/api/index.ts         | 10 +++++--
 .../src/api/to-auth-endpoints.test.ts         | 29 ++++++++++++++++---
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/packages/better-auth/src/api/index.ts b/packages/better-auth/src/api/index.ts
index 164162869e..528d653f37 100644
--- a/packages/better-auth/src/api/index.ts
+++ b/packages/better-auth/src/api/index.ts
@@ -267,8 +267,14 @@ export const router = <Option extends BetterAuthOptions>(
 		async onRequest(req) {
 			//handle disabled paths
 			const disabledPaths = ctx.options.disabledPaths || [];
-			const path = new URL(req.url).pathname.replace(basePath, "");
-			if (disabledPaths.includes(path)) {
+			const pathname = new URL(req.url).pathname;
+			const normalizedPath =
+				basePath === "/"
+					? pathname
+					: pathname.startsWith(basePath)
+						? pathname.slice(basePath.length) || "/"
+						: pathname;
+			if (disabledPaths.includes(normalizedPath)) {
 				return new Response("Not Found", { status: 404 });
 			}
 			for (const plugin of ctx.options.plugins || []) {
diff --git a/packages/better-auth/src/api/to-auth-endpoints.test.ts b/packages/better-auth/src/api/to-auth-endpoints.test.ts
index 1b29fd08ee..4d38537193 100644
--- a/packages/better-auth/src/api/to-auth-endpoints.test.ts
+++ b/packages/better-auth/src/api/to-auth-endpoints.test.ts
@@ -422,11 +422,11 @@ describe("after hook", async () => {
 });
 
 describe("disabled paths", async () => {
-	const { client } = await getTestInstance({
-		disabledPaths: ["/sign-in/email"],
-	});
-
 	it("should return 404 for disabled paths", async () => {
+		const { client, auth } = await getTestInstance({
+			disabledPaths: ["/sign-in/email"],
+		});
+
 		const response = await client.$fetch("/ok");
 		expect(response.data).toEqual({ ok: true });
 		const { error } = await client.signIn.email({
@@ -435,6 +435,27 @@ describe("disabled paths", async () => {
 		});
 		expect(error?.status).toBe(404);
 	});
+
+	it("should return 404 for when base path is /", async () => {
+		const { auth } = await getTestInstance({
+			basePath: "/",
+			disabledPaths: ["/sign-in/email"],
+		});
+
+		const response2 = await auth.handler(
+			new Request("http://localhost:3000/sign-in/email", {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					email: "test@test.com",
+					password: "test",
+				}),
+			}),
+		);
+		expect(response2).toBeInstanceOf(Response);
+	});
 });
 
 describe("debug mode stack trace", () => {