From bf42379be3ffe2a4dc6061e49a9ce3452f385cbb Mon Sep 17 00:00:00 2001 From: Taesu <166604494+bytaesu@users.noreply.github.com> Date: Mon, 29 Dec 2025 21:22:23 +0900 Subject: [PATCH] fix(client): apply rate limit focus refetch regardless of session state (#7048) Co-authored-by: Alex Yang --- .../better-auth/src/client/session-refresh.test.ts | 12 ++++++------ packages/better-auth/src/client/session-refresh.ts | 10 ++-------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/packages/better-auth/src/client/session-refresh.test.ts b/packages/better-auth/src/client/session-refresh.test.ts index 647829d999..307456a852 100644 --- a/packages/better-auth/src/client/session-refresh.test.ts +++ b/packages/better-auth/src/client/session-refresh.test.ts @@ -172,7 +172,7 @@ describe("session-refresh", () => { vi.useRealTimers(); }); - it("should allow refetch on focus when session is null even within rate limit", async () => { + it("should rate limit refetch on focus when session is null", async () => { const sessionAtom: SessionAtom = atom({ data: { user: { id: "1", email: "test@test.com" }, @@ -223,15 +223,15 @@ describe("session-refresh", () => { // Immediately trigger another focus event (within rate limit window) manager.triggerRefetch({ event: "visibilitychange" }); - // Signal should change because session is null (rate limit bypassed) - expect(signalChangeCount).toBeGreaterThan(signalCountAfterFirstFocus); + // Signal should NOT change because rate limit should apply even when session is null + expect(signalChangeCount).toBe(signalCountAfterFirstFocus); unsubscribeSignal(); manager.cleanup(); vi.useRealTimers(); }); - it("should allow refetch on focus when session is undefined even within rate limit", async () => { + it("should rate limit refetch on focus when session is undefined", async () => { const sessionAtom: SessionAtom = atom({ data: { user: { id: "1", email: "test@test.com" }, @@ -282,8 +282,8 @@ describe("session-refresh", () => { // Immediately trigger another focus event (within rate limit window) manager.triggerRefetch({ event: "visibilitychange" }); - // Signal should change because session is undefined (rate limit bypassed) - expect(signalChangeCount).toBeGreaterThan(signalCountAfterFirstFocus); + // Signal should NOT change because rate limit should apply even when session is undefined + expect(signalChangeCount).toBe(signalCountAfterFirstFocus); unsubscribeSignal(); manager.cleanup(); diff --git a/packages/better-auth/src/client/session-refresh.ts b/packages/better-auth/src/client/session-refresh.ts index f70f1dd15f..e3fa0b8513 100644 --- a/packages/better-auth/src/client/session-refresh.ts +++ b/packages/better-auth/src/client/session-refresh.ts @@ -100,13 +100,10 @@ export function createSessionRefreshManager(opts: SessionRefreshOptions) { // Rate limit: don't refetch on focus if a session request was made recently if (event?.event === "visibilitychange") { const timeSinceLastRequest = now() - state.lastSessionRequest; - if ( - timeSinceLastRequest < FOCUS_REFETCH_RATE_LIMIT_SECONDS && - currentSession?.data !== null && - currentSession?.data !== undefined - ) { + if (timeSinceLastRequest < FOCUS_REFETCH_RATE_LIMIT_SECONDS) { return; } + state.lastSessionRequest = now(); } if ( @@ -114,9 +111,6 @@ export function createSessionRefreshManager(opts: SessionRefreshOptions) { currentSession?.data === undefined || event?.event === "visibilitychange" ) { - if (event?.event === "visibilitychange") { - state.lastSessionRequest = now(); - } state.lastSync = now(); sessionSignal.set(!sessionSignal.get()); }