github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #5573] Email & Password Sign Up/Logout throws 403 MISSING_OR_NULL_ORIGIN #10288

New Issue
Open
opened 2026-04-13 06:19:07 -05:00 by GiteaMirror · 14 comments
GiteaMirror commented 2026-04-13 06:19:07 -05:00
Owner
Copy Link

Originally created by @royjosephargumido on GitHub (Oct 25, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5573

Originally assigned to: @bytaesu on GitHub.

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Sign Out:

  1. Upgrade to better-auth 1.3.31
  2. Using Postman 11.68.5, clear all Cookies
  3. Successfully sign in using Email and Password
  4. After signing in, sign out.
  5. Throws 403, MISSING_OR_NULL_ORIGIN.

After the above process, try signing in using Email and Password:

  1. Throws 403, MISSING_OR_NULL_ORIGIN.

Current vs. Expected behavior

Current Behavior:
When attempting to sign in using Email and Password with better-auth version 1.3.31, the request fails with a 403 Forbidden error. The response returns:

{
	"code": "MISSING_OR_NULL_ORIGIN",
	"message": "Missing or null Origin"
}

To temporarily resolve, I cleared all Postman cookies and retries the sign in. However, after successful sign in, the sign out throws the same error. Further, after successful sign in, attempting to sign in again using Email and Password throws the same error.

Expected Behavior:
Signing in using a valid and correct Email and Password should return a successful response, indicating a complete sign in process. Likewise, users should be able to sign out successfully. Furthermore, signing in again even if already signed in, should also result in a successful email sign in.

What version of Better Auth are you using?

1.3.31

System info

{
  "system": {
    "platform": "win32",
    "arch": "x64",
    "version": "Windows 11 Home",
    "release": "10.0.26200",
    "cpuCount": 8,
    "cpuModel": "11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz",
    "totalMemory": "23.73 GB",
    "freeMemory": "12.15 GB"
  },
  "node": {
    "version": "v24.9.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.6.0"
  },
  "frameworks": null,
  "databases": [
    {
      "name": "pg",
      "version": "^8.16.3"
    },
    {
      "name": "drizzle",
      "version": "^0.44.7"
    }
  ],
  "betterAuth": {
    "version": "^1.3.31",
    "config": {
      "appName": "redacted",
      "emailAndPassword": {
        "enabled": true,
        "requireEmailVerification": true
      },
      "plugins": [
        {
          "name": "open-api",
          "config": {
            "id": "open-api",
            "endpoints": {}
          }
        }
      ],
      "emailVerification": {
        "sendOnSignUp": true
      },
      "telemetry": {
        "enabled": false
      }
    }
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

I am using the latest version of NestJS and its dependencies. I have never used it on a browser/frontend. I downgraded to better-auth version 1.3.28 and its working. I think https://github.com/better-auth/better-auth/issues/5536 may have caused this issue.

Originally created by @royjosephargumido on GitHub (Oct 25, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5573 Originally assigned to: @bytaesu on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Sign Out: 1. Upgrade to better-auth 1.3.31 3. Using Postman 11.68.5, clear all Cookies 4. Successfully sign in using Email and Password 5. After signing in, sign out. 6. Throws 403, `MISSING_OR_NULL_ORIGIN`. After the above process, try signing in using Email and Password: 1. Throws 403, `MISSING_OR_NULL_ORIGIN`. ### Current vs. Expected behavior **Current Behavior:** When attempting to sign in using Email and Password with better-auth version 1.3.31, the request fails with a `403 Forbidden` error. The response returns: ``` { "code": "MISSING_OR_NULL_ORIGIN", "message": "Missing or null Origin" } ``` To temporarily resolve, I cleared all Postman cookies and retries the sign in. However, after successful sign in, the sign out throws the same error. Further, after successful sign in, attempting to sign in again using Email and Password throws the same error. **Expected Behavior:** Signing in using a valid and correct Email and Password should return a successful response, indicating a complete sign in process. Likewise, users should be able to sign out successfully. Furthermore, signing in again even if already signed in, should also result in a successful email sign in. ### What version of Better Auth are you using? 1.3.31 ### System info ```bash { "system": { "platform": "win32", "arch": "x64", "version": "Windows 11 Home", "release": "10.0.26200", "cpuCount": 8, "cpuModel": "11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz", "totalMemory": "23.73 GB", "freeMemory": "12.15 GB" }, "node": { "version": "v24.9.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.6.0" }, "frameworks": null, "databases": [ { "name": "pg", "version": "^8.16.3" }, { "name": "drizzle", "version": "^0.44.7" } ], "betterAuth": { "version": "^1.3.31", "config": { "appName": "redacted", "emailAndPassword": { "enabled": true, "requireEmailVerification": true }, "plugins": [ { "name": "open-api", "config": { "id": "open-api", "endpoints": {} } } ], "emailVerification": { "sendOnSignUp": true }, "telemetry": { "enabled": false } } } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context I am using the latest version of NestJS and its dependencies. I have never used it on a browser/frontend. I downgraded to better-auth version 1.3.28 and its working. I think https://github.com/better-auth/better-auth/issues/5536 may have caused this issue.
GiteaMirror added the credentialscorebug labels 2026-04-13 06:19:07 -05:00
GiteaMirror commented 2026-04-13 06:19:08 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Oct 25, 2025):

Hi @royjosephargumido! I'm Dosu and I’m helping the better-auth team.

This is a regression caused by stricter Origin header enforcement introduced in better-auth v1.3.29 and later. In these versions, any POST request using cookies (like sign in or sign out) must include a valid Origin or Referer header, or it will fail with a 403 MISSING_OR_NULL_ORIGIN error. This breaks flows in environments like Postman or backend-only setups where the Origin header is often missing by default [details].

To resolve this for backend/non-browser environments, add the following to your better-auth config:

export const auth = betterAuth({
  emailAndPassword: { enabled: true },
  advanced: { disableOriginCheck: true }
});

This disables the strict Origin check and allows requests without an Origin header to succeed [code reference]. Only use this in isolated development environments, as it reduces CSRF protection.

Issue #5536 is the canonical tracking ticket for this problem, and downgrading to v1.3.28 works because it did not enforce the Origin header as strictly. If you need strict CSRF protection in production, ensure your clients always send a valid Origin header and configure trustedOrigins accordingly [docs].

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3446685801 --> @dosubot[bot] commented on GitHub (Oct 25, 2025): <!-- Greeting --> Hi @royjosephargumido! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> This is a regression caused by stricter Origin header enforcement introduced in better-auth v1.3.29 and later. In these versions, any POST request using cookies (like sign in or sign out) must include a valid Origin or Referer header, or it will fail with a 403 MISSING_OR_NULL_ORIGIN error. This breaks flows in environments like Postman or backend-only setups where the Origin header is often missing by default [[details](https://github.com/better-auth/better-auth/issues/5536)]. To resolve this for backend/non-browser environments, add the following to your better-auth config: ```typescript export const auth = betterAuth({ emailAndPassword: { enabled: true }, advanced: { disableOriginCheck: true } }); ``` This disables the strict Origin check and allows requests without an Origin header to succeed [[code reference](https://github.com/better-auth/better-auth/pull/5411)]. Only use this in isolated development environments, as it reduces CSRF protection. Issue #5536 is the canonical tracking ticket for this problem, and downgrading to v1.3.28 works because it did not enforce the Origin header as strictly. If you need strict CSRF protection in production, ensure your clients always send a valid Origin header and configure trustedOrigins accordingly [[docs](https://github.com/better-auth/better-auth/issues/3874)]. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/d46dfea3-62b1-4a62-b7a0-6f27a9c66926?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5573)
GiteaMirror commented 2026-04-13 06:19:08 -05:00
Author
Owner
Copy Link

@R5dan commented on GitHub (Oct 25, 2025):

@royjosephargumido Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the API Key or Device Authorization plugin for untrusted services. Alternativly, for trusted services you can create a new betterAuthClient and adding trustedOrigins option to the server betterAuth. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that

<!-- gh-comment-id:3446731627 --> @R5dan commented on GitHub (Oct 25, 2025): @royjosephargumido Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the `API Key` or `Device Authorization` plugin for untrusted services. Alternativly, for trusted services you can create a new `betterAuthClient` and adding `trustedOrigins` option to the server `betterAuth`. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that
GiteaMirror commented 2026-04-13 06:19:09 -05:00
Author
Owner
Copy Link

@royjosephargumido commented on GitHub (Oct 25, 2025):

@royjosephargumido Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the API Key or Device Authorization plugin for untrusted services. Alternativly, for trusted services you can create a new betterAuthClient and adding trustedOrigins option to the server betterAuth. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that

Yeah. I already implemented both advanced.disableOriginCheck, trustedOrigins, and updated my other implementations based from these info. I will consider your suggestions. Thanks.

<!-- gh-comment-id:3446753386 --> @royjosephargumido commented on GitHub (Oct 25, 2025): > [@royjosephargumido](https://github.com/royjosephargumido) Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the `API Key` or `Device Authorization` plugin for untrusted services. Alternativly, for trusted services you can create a new `betterAuthClient` and adding `trustedOrigins` option to the server `betterAuth`. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that Yeah. I already implemented both `advanced.disableOriginCheck`, `trustedOrigins`, and updated my other implementations based from these info. I will consider your suggestions. Thanks.
GiteaMirror commented 2026-04-13 06:19:09 -05:00
Author
Owner
Copy Link

@R5dan commented on GitHub (Oct 25, 2025):

@royjosephargumido I have just realized you are using the open api plugin, which will allow you to test it in your own site:

https://www.better-auth.com/docs/plugins/open-api#generated-schema
https://www.better-auth.com/docs/plugins/open-api#using-scalar-with-multiple-sources
https://guides.scalar.com/scalar/scalar-api-references/getting-started

<!-- gh-comment-id:3446833031 --> @R5dan commented on GitHub (Oct 25, 2025): @royjosephargumido I have just realized you are using the open api plugin, which will allow you to test it in your own site: https://www.better-auth.com/docs/plugins/open-api#generated-schema https://www.better-auth.com/docs/plugins/open-api#using-scalar-with-multiple-sources https://guides.scalar.com/scalar/scalar-api-references/getting-started
GiteaMirror commented 2026-04-13 06:19:10 -05:00
Author
Owner
Copy Link

@nicholsss commented on GitHub (Nov 4, 2025):

@royjosephargumido Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the API Key or Device Authorization plugin for untrusted services. Alternativly, for trusted services you can create a new betterAuthClient and adding trustedOrigins option to the server betterAuth. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that

Yeah. I already implemented both advanced.disableOriginCheck, trustedOrigins, and updated my other implementations based from these info. I will consider your suggestions. Thanks.

Were u able to fix this issue? Im facing the same problem

<!-- gh-comment-id:3486387853 --> @nicholsss commented on GitHub (Nov 4, 2025): > > [@royjosephargumido](https://github.com/royjosephargumido) Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the `API Key` or `Device Authorization` plugin for untrusted services. Alternativly, for trusted services you can create a new `betterAuthClient` and adding `trustedOrigins` option to the server `betterAuth`. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that > > Yeah. I already implemented both `advanced.disableOriginCheck`, `trustedOrigins`, and updated my other implementations based from these info. I will consider your suggestions. Thanks. Were u able to fix this issue? Im facing the same problem
GiteaMirror commented 2026-04-13 06:19:10 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 4, 2025):

Hey there! It looks like you’re running into the same “MISSING_OR_NULL_ORIGIN” error when signing out and then signing in with email and password. This error indicates that Better Auth’s security check isn’t receiving a valid Origin header with your request.

Here are a few next steps to troubleshoot and potentially resolve the issue:

• Ensure that your client (Postman in this case) is sending the appropriate Origin header with each request. Depending on your testing setup, Postman might not automatically include this header, so you may need to add it manually.

• Consider updating your server configuration by adding your testing environment’s URL to the trustedOrigins option. This way, Better Auth will recognize the request as coming from a trusted source—even when using Postman [1].

• As a temporary workaround, you could disable the origin check via advanced.disableOriginCheck, but remember that disabling this check can expose potential security vulnerabilities [1].

• Since you mentioned that downgrading to a previous version (1.3.28) resolves the issue, it suggests that recent changes in version 1.3.31 may have introduced stricter origin validation. If you’re testing on trusted networks, configuring a dedicated client with trustedOrigins might be the best long-term solution.

Does this help clarify the next steps for you? tag @better-auth-agent

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3486390029 --> @better-auth-agent[bot] commented on GitHub (Nov 4, 2025): Hey there! It looks like you’re running into the same “MISSING_OR_NULL_ORIGIN” error when signing out and then signing in with email and password. This error indicates that Better Auth’s security check isn’t receiving a valid Origin header with your request. Here are a few next steps to troubleshoot and potentially resolve the issue: • Ensure that your client (Postman in this case) is sending the appropriate Origin header with each request. Depending on your testing setup, Postman might not automatically include this header, so you may need to add it manually. • Consider updating your server configuration by adding your testing environment’s URL to the trustedOrigins option. This way, Better Auth will recognize the request as coming from a trusted source—even when using Postman [[1]](https://github.com/better-auth/better-auth/issues/5573). • As a temporary workaround, you could disable the origin check via advanced.disableOriginCheck, but remember that disabling this check can expose potential security vulnerabilities [[1]](https://github.com/better-auth/better-auth/issues/5573). • Since you mentioned that downgrading to a previous version (1.3.28) resolves the issue, it suggests that recent changes in version 1.3.31 may have introduced stricter origin validation. If you’re testing on trusted networks, configuring a dedicated client with trustedOrigins might be the best long-term solution. Does this help clarify the next steps for you? tag @better-auth-agent <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-13 06:19:11 -05:00
Author
Owner
Copy Link

@royjosephargumido commented on GitHub (Nov 16, 2025):

@royjosephargumido Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the API Key or Device Authorization plugin for untrusted services. Alternativly, for trusted services you can create a new betterAuthClient and adding trustedOrigins option to the server betterAuth. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that

Yeah. I already implemented both advanced.disableOriginCheck, trustedOrigins, and updated my other implementations based from these info. I will consider your suggestions. Thanks.

Were u able to fix this issue? Im facing the same problem

Yes. As mentioned above, I added the following to the BetterAuthOptions:

RESOLUTION:

I resolved the issue by adding the following to the BetterAuthOptions:

advanced: {
		disableOriginCheck: process.env.NODE_ENV !== 'production',
		useSecureCookies: process.env.NODE_ENV === 'production',
	},
	trustedOrigins: [
		// Your trusted origins. Example:
		'http://localhost:8080',
	],

Also, I added the same origins to the NestJS' CORS configuration.

<!-- gh-comment-id:3537567632 --> @royjosephargumido commented on GitHub (Nov 16, 2025): > > > [@royjosephargumido](https://github.com/royjosephargumido) Better Auth automatically ensures that authentication requests are from your application. If you require authentication from another server please consider the `API Key` or `Device Authorization` plugin for untrusted services. Alternativly, for trusted services you can create a new `betterAuthClient` and adding `trustedOrigins` option to the server `betterAuth`. Alternatively (like the bot said) you can disable origin check, however this is highly unadvised as it can cause security vulnerabilities. Due to these limitations, I would advice that to test your authentication you make a new client and call the functions from there and setup your server to allow your ip address. I am unfamiliar with postman and whether it allows you to set the origin of the request you are making which would allow you to not test via that and add its origin. But like I said, I would advice being careful with that > > > > > > Yeah. I already implemented both `advanced.disableOriginCheck`, `trustedOrigins`, and updated my other implementations based from these info. I will consider your suggestions. Thanks. > > Were u able to fix this issue? Im facing the same problem Yes. As mentioned above, I added the following to the `BetterAuthOptions`: **RESOLUTION:** I resolved the issue by adding the following to the `BetterAuthOptions`: ``` advanced: { disableOriginCheck: process.env.NODE_ENV !== 'production', useSecureCookies: process.env.NODE_ENV === 'production', }, trustedOrigins: [ // Your trusted origins. Example: 'http://localhost:8080', ], ``` Also, I added the same origins to the NestJS' CORS configuration.
GiteaMirror commented 2026-04-13 06:19:12 -05:00
Author
Owner
Copy Link

@buiducnhat commented on GitHub (Dec 9, 2025):

Same for me, only occuring with expo

<!-- gh-comment-id:3633024309 --> @buiducnhat commented on GitHub (Dec 9, 2025): Same for me, only occuring with expo
GiteaMirror commented 2026-04-13 06:19:13 -05:00
Author
Owner
Copy Link

@tsatsujnr139 commented on GitHub (Dec 16, 2025):

I'm facing this issue as well only on signOut route in expo.

<!-- gh-comment-id:3660438961 --> @tsatsujnr139 commented on GitHub (Dec 16, 2025): I'm facing this issue as well only on signOut route in expo.
GiteaMirror commented 2026-04-13 06:19:13 -05:00
Author
Owner
Copy Link

@gmr458 commented on GitHub (Dec 30, 2025):

I cannot login when using Bruno, when using curl it works.

Image
<!-- gh-comment-id:3698215706 --> @gmr458 commented on GitHub (Dec 30, 2025): I cannot login when using Bruno, when using curl it works. <img width="1099" height="303" alt="Image" src="https://github.com/user-attachments/assets/9ed376ff-6900-4da1-ad95-a2cfa9e38d2e" />
GiteaMirror commented 2026-04-13 06:19:14 -05:00
Author
Owner
Copy Link

@RichardSPrins commented on GitHub (Jan 20, 2026):

I'm getting this in Bruno as well, it worked for a moment but then throws this error. I want to keep origin check in place but want to be able to allow my Bruno client to use the API

<!-- gh-comment-id:3774750678 --> @RichardSPrins commented on GitHub (Jan 20, 2026): I'm getting this in Bruno as well, it worked for a moment but then throws this error. I want to keep origin check in place but want to be able to allow my Bruno client to use the API
GiteaMirror commented 2026-04-13 06:19:15 -05:00
Author
Owner
Copy Link

@gmr458 commented on GitHub (Jan 21, 2026):

For now I've disabled origin check only in development with the option advanced.disableOriginCheck like this:

export const auth = betterAuth({
    advanced: {
        disableOriginCheck: env.NODE_ENV !== "production",
    },
});
<!-- gh-comment-id:3775826808 --> @gmr458 commented on GitHub (Jan 21, 2026): For now I've disabled origin check only in development with the option `advanced.disableOriginCheck` like this: ```typescript export const auth = betterAuth({ advanced: { disableOriginCheck: env.NODE_ENV !== "production", }, }); ```
GiteaMirror commented 2026-04-13 06:19:17 -05:00
Author
Owner
Copy Link

@samzmann commented on GitHub (Feb 5, 2026):

For me what seems to have solved it was to add the expo plugin to my server, which I had missed form the docs. It seems like every example config given in the comments above is missing it too 😅.

So correct would be:

import { betterAuth } from "better-auth";
import { expo } from "@better-auth/expo";

export const auth = betterAuth({
    plugins: [
      expo() // <-------------------- here
    ],
    trustedOrigins: [
      // fill with correct app scheme and metro bundler urls as per docs
    ]
})
<!-- gh-comment-id:3852832924 --> @samzmann commented on GitHub (Feb 5, 2026): For me what seems to have solved it was to add the `expo` plugin to my server, which I had missed form the [docs](https://www.better-auth.com/docs/integrations/expo#add-the-expo-plugin-on-your-server). It seems like every example config given in the comments above is missing it too 😅. So correct would be: ```ts import { betterAuth } from "better-auth"; import { expo } from "@better-auth/expo"; export const auth = betterAuth({ plugins: [ expo() // <-------------------- here ], trustedOrigins: [ // fill with correct app scheme and metro bundler urls as per docs ] }) ```
GiteaMirror commented 2026-04-13 06:19:19 -05:00
Author
Owner
Copy Link

@till commented on GitHub (Feb 23, 2026):

I am getting this error when I am part of an oauth2 flow.

Basically:

  1. click "login with oauth" in another app
  2. first redirect to better-auth
  3. prompt=login triggers redirect to login form
  4. firefox sends Origin: "null"
  5. error
<!-- gh-comment-id:3944219082 --> @till commented on GitHub (Feb 23, 2026): I am getting this error when I am part of an oauth2 flow. Basically: 1. click "login with oauth" in another app 2. first redirect to better-auth 3. `prompt=login` triggers redirect to login form 4. firefox sends `Origin: "null"` 5. error
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug core credentials
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10288
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?