github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6358] Documentation gap: v1.4.0 default User-Agent header may cause Safari CORS errors (undocumented breaking change) #10495

New Issue
Closed
opened 2026-04-13 06:40:52 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-13 06:40:52 -05:00
Owner
Copy Link

Originally created by @shinaps on GitHub (Nov 27, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6358

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Set up a project with better-auth v1.4.0 or higher
  2. Configure CORS on the API without explicitly including user-agent in allowHeaders: 
    // Example with Hono
app.use('/api/auth/*', cors({
  origin: 'http://localhost:5173',
  allowHeaders: ['Content-Type', 'Authorization'], // user-agent NOT included
  allowMethods: ['POST', 'GET', 'OPTIONS'],
  credentials: true,
}))
  3. Access the application from Safari browser
  4. Attempt to authenticate
  5. Observe CORS preflight request failure in Safari DevTools

Reproduction repository: https://github.com/shinaps/2025-11-27-better-auth-debug

You can toggle between working and broken versions by changing the better-auth version in pnpm-workspace.yaml

Current vs. Expected behavior

Current Behavior:

  • Starting from v1.4.0, better-auth includes a custom User-Agent: better-auth header in requests
  • Safari browser blocks these requests with CORS errors when the API's CORS configuration does not explicitly include user-agent in allowHeaders
  • This change was not documented in the v1.4.0 release blog as a breaking change
  • Developers upgrading from v1.3.x to v1.4.0+ encounter unexpected CORS failures in Safari

Expected Behavior:

  • Breaking changes that affect browser compatibility should be documented in release notes
  • The migration guide should mention the need to add User-Agent to CORS allowHeaders configuration or use disableDefaultFetchPlugins to disable default user-agent

What version of Better Auth are you using?

1.4.3

System info

N/A

Which area(s) are affected? (Select all that apply)

Client, Documentation, Backend

Auth config (if applicable)

Additional context

No response

Originally created by @shinaps on GitHub (Nov 27, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6358 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Set up a project with better-auth **v1.4.0 or higher** 2. Configure CORS on the API without explicitly including `user-agent` in `allowHeaders`: ```typescript // Example with Hono app.use('/api/auth/*', cors({ origin: 'http://localhost:5173', allowHeaders: ['Content-Type', 'Authorization'], // user-agent NOT included allowMethods: ['POST', 'GET', 'OPTIONS'], credentials: true, })) 3. Access the application from Safari browser 4. Attempt to authenticate 5. Observe CORS preflight request failure in Safari DevTools Reproduction repository: https://github.com/shinaps/2025-11-27-better-auth-debug You can toggle between working and broken versions by changing the better-auth version in pnpm-workspace.yaml ### Current vs. Expected behavior **Current Behavior:** - Starting from v1.4.0, better-auth includes a custom `User-Agent: better-auth` header in requests - Safari browser blocks these requests with CORS errors when the API's CORS configuration does not explicitly include `user-agent` in `allowHeaders` - This change was not documented in the [v1.4.0 release blog ](https://www.better-auth.com/blog/1-4#%EF%B8%8F-breaking-changes) as a breaking change - Developers upgrading from v1.3.x to v1.4.0+ encounter unexpected CORS failures in Safari **Expected Behavior:** - Breaking changes that affect browser compatibility should be documented in release notes - The migration guide should mention the need to add `User-Agent` to CORS `allowHeaders` configuration or use `disableDefaultFetchPlugins` to disable default user-agent ### What version of Better Auth are you using? 1.4.3 ### System info ```bash N/A ``` ### Which area(s) are affected? (Select all that apply) Client, Documentation, Backend ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_
GiteaMirror added the locked label 2026-04-13 06:40:52 -05:00
GiteaMirror commented 2026-04-13 06:40:55 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Nov 27, 2025):

It looks like the default inclusion of the “User-Agent: better-auth” header starting with v1.4.0 is causing unexpected CORS failures in Safari when it isn’t explicitly allowed by your API’s CORS configuration. As a workaround, please update your CORS allowHeaders to include “user-agent” or disable the default behavior by using disableDefaultFetchPlugins so that the header isn’t added automatically [1]. Have you tried updating your CORS settings to include “user-agent,” or would you like further assistance in configuring your API? Tag @better-auth-agent if you would like an answer from the Agent.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3586182677 --> @better-auth-agent[bot] commented on GitHub (Nov 27, 2025): It looks like the default inclusion of the “User-Agent: better-auth” header starting with v1.4.0 is causing unexpected CORS failures in Safari when it isn’t explicitly allowed by your API’s CORS configuration. As a workaround, please update your CORS allowHeaders to include “user-agent” or disable the default behavior by using disableDefaultFetchPlugins so that the header isn’t added automatically [[1]](https://github.com/better-auth/better-auth/issues/4125). Have you tried updating your CORS settings to include “user-agent,” or would you like further assistance in configuring your API? Tag @better-auth-agent if you would like an answer from the Agent. <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10495
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?