github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-24 14:34:26 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6799] Session refresh writes on GET request #10633

New Issue
Closed
opened 2026-04-13 06:52:50 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-13 06:52:50 -05:00
Owner
Copy Link
Copy Source

Originally created by @mnlfischer on GitHub (Dec 16, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6799

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I have the problem that I am using the LiteFS proxy from Fly.io, and this proxy cannot perform write operations during a GET request. When my session has expired, better-auth performs an update. However, if there are multiple databases, the GET request may be routed to a replica database instance, and writes on a replica are forbidden. The proxy only forwards POST requests to the primary database, since only the primary is allowed to perform writes.

Is it possible to send the session GET request as a POST request as an optional configuration?

This issue is not specific to Fly. It also impacts database replica configurations that rely on correct HTTP methods to ensure requests are routed to the correct primary or replica database.

Fly Reference:
For most web applications, you can take advantage of load balancer configuration to route writes to the primary node, assuming your application follows the convention of avoiding write operations (INSERT, UPDATE, etc.) on GET requests.

I disabled session refresh for now.

Current vs. Expected behavior

getSession refreshes the session in the database via GET Request , I expect writing operations with the corret http method.

What version of Better Auth are you using?

1.4.6

System info

no outpud for whatever reason

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({
  database: prismaAdapter(prisma, {
    provider: "sqlite",
  }),
  user: {
    additionalFields: {
      first_name: {
        type: "string",
        input: false,
      },
      last_name: {
        type: "string",
        input: false,
      },
    },
  },
  advanced: {
    database: {
      generateId: () => cuid(),
    },
  },
  session: {
    disableSessionRefresh: true,
    expiresIn: 60 * 60 * 24 * 7,
  },
  telemetry: {
    enabled: false,
  },
  plugins: [
    magicLink({...
      },
    }),
    admin(),
  ],
});

Additional context

No response

Originally created by @mnlfischer on GitHub (Dec 16, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6799 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce I have the problem that I am using the LiteFS proxy from Fly.io, and this proxy cannot perform write operations during a GET request. When my session has expired, better-auth performs an update. However, if there are multiple databases, the GET request may be routed to a replica database instance, and writes on a replica are forbidden. The proxy only forwards POST requests to the primary database, since only the primary is allowed to perform writes. Is it possible to send the session GET request as a POST request as an optional configuration? This issue is not specific to Fly. It also impacts database replica configurations that rely on correct HTTP methods to ensure requests are routed to the correct primary or replica database. Fly Reference: For most web applications, you can take advantage of load balancer configuration to route writes to the primary node, assuming your application follows the convention of avoiding write operations (INSERT, UPDATE, etc.) on GET requests. I disabled session refresh for now. ### Current vs. Expected behavior getSession refreshes the session in the database via GET Request , I expect writing operations with the corret http method. ### What version of Better Auth are you using? 1.4.6 ### System info ```bash no outpud for whatever reason ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ database: prismaAdapter(prisma, { provider: "sqlite", }), user: { additionalFields: { first_name: { type: "string", input: false, }, last_name: { type: "string", input: false, }, }, }, advanced: { database: { generateId: () => cuid(), }, }, session: { disableSessionRefresh: true, expiresIn: 60 * 60 * 24 * 7, }, telemetry: { enabled: false, }, plugins: [ magicLink({... }, }), admin(), ], }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-13 06:52:50 -05:00
GiteaMirror commented 2026-04-13 06:52:51 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Dec 16, 2025):

Thanks for reporting this – sorry for the inconvenience you're experiencing with GET-based session refresh. At the moment, the session refresh update is performed via GET, and there isn’t an option to force that request to be sent as a POST. This behavior was implemented to simplify session cookie updates; however, it’s understandable that it can conflict with load balancer or proxy configurations like LiteFS where writes must be handled by POSTs to the primary instance.

One current workaround, as you noted, is to disable session refresh. We’ll consider your use case for a future version and evaluate whether making the HTTP method configurable is feasible. In the meantime, could you provide additional details on your proxy and database replica setup so we can better assess the issue?

Tag @better-auth-agent if you would like an answer from the Agent.

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3660531877 --> @better-auth-agent[bot] commented on GitHub (Dec 16, 2025): Thanks for reporting this – sorry for the inconvenience you're experiencing with GET-based session refresh. At the moment, the session refresh update is performed via GET, and there isn’t an option to force that request to be sent as a POST. This behavior was implemented to simplify session cookie updates; however, it’s understandable that it can conflict with load balancer or proxy configurations like LiteFS where writes must be handled by POSTs to the primary instance. One current workaround, as you noted, is to disable session refresh. We’ll consider your use case for a future version and evaluate whether making the HTTP method configurable is feasible. In the meantime, could you provide additional details on your proxy and database replica setup so we can better assess the issue? Tag @better-auth-agent if you would like an answer from the Agent. _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-04-13 06:52:52 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 16, 2025):

Better Auth currently performs session refresh writes inside a GET request to the /get-session endpoint, and there is no configuration option to change this to a POST request in v1.4.6 or recent versions. This is problematic for setups like Fly.io LiteFS or any environment with read replicas, since GET requests may be routed to replicas (which cannot handle writes), while POST requests are routed to the primary for writes. The only built-in workaround is to disable session refresh, which you’ve already done reference.

There’s no supported way to trigger session refresh via POST or to configure the HTTP method for this endpoint. This limitation is known for other endpoints as well (for example, Stripe billing portal sessions default to GET unless you manually override the method in client code) reference.

If you need session refresh with correct HTTP method routing, you’d need to implement a custom endpoint or middleware that performs the refresh logic via POST, but this isn’t supported out of the box and would require forking or wrapping the current implementation.

A feature to allow configuring the HTTP method for session refresh would benefit users in environments with read/write separation and is a reasonable candidate for a future update. For now, disabling session refresh is the only reliable workaround.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3660540959 --> @dosubot[bot] commented on GitHub (Dec 16, 2025): <!-- Answer --> Better Auth currently performs session refresh writes inside a GET request to the `/get-session` endpoint, and there is no configuration option to change this to a POST request in v1.4.6 or recent versions. This is problematic for setups like Fly.io LiteFS or any environment with read replicas, since GET requests may be routed to replicas (which cannot handle writes), while POST requests are routed to the primary for writes. The only built-in workaround is to disable session refresh, which you’ve already done [reference](https://github.com/better-auth/better-auth/blob/1c671650504b31626c7e12082b73b8e7832b7a5d/packages/better-auth/src/api/routes/session.ts#L29-L450). There’s no supported way to trigger session refresh via POST or to configure the HTTP method for this endpoint. This limitation is known for other endpoints as well (for example, Stripe billing portal sessions default to GET unless you manually override the method in client code) [reference](https://github.com/better-auth/better-auth/issues/4611). If you need session refresh with correct HTTP method routing, you’d need to implement a custom endpoint or middleware that performs the refresh logic via POST, but this isn’t supported out of the box and would require forking or wrapping the current implementation. A feature to allow configuring the HTTP method for session refresh would benefit users in environments with read/write separation and is a reasonable candidate for a future update. For now, disabling session refresh is the only reliable workaround. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/b58cfdc8-eb00-4bdd-9711-aabb13c4cd0b?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Better%20Auth%20currently%20performs%20session%20refresh%20writes%20inside%20a%20GET%20request%20to%20the%20%60/get-session%60%20endpoint%2C%20and%20there%20is%20no%20configuration%20option%20to%20change%20this%20to%20a%20POST%20request%20in%20v1.4.6%20or%20recent%20versions.%20This%20is%20problematic%20for%20setups%20like%20Fly.io%20LiteFS%20or%20any%20environment%20with%20read%20replicas%2C%20since%20GET%20requests%20may%20be%20routed%20to%20replicas%20%28which%20cannot%20handle%20writes%29%2C%20while%20POST%20requests%20are%20routed%20to%20the%20primary%20for%20writes.%20The%20only%20built-in%20workaround%20is%20to%20disable%20session%20refresh%2C%20which%20you%E2%80%99ve%20already%20done%C2%A0%5Breference%5D%28https%3A//github.com/better-auth/better-auth/blob/1c671650504b31626c7e12082b73b8e7832b7a5d/packages/better-auth/src/api/routes/session.ts%23L29-L450%29.%0A%0AThere%E2%80%99s%20no%20supported%20way%20to%20trigger%20session%20refresh%20via%20POST%20or%20to%20configure%20the%20HTTP%20method%20for%20this%20endpoint.%20This%20limitation%20is%20known%20for%20other%20endpoints%20as%20well%20%28for%20example%2C%20Stripe%20billing%20portal%20sessions%20default%20to%20GET%20unless%20you%20manually%20override%20the%20method%20in%20client%20code%29%C2%A0%5Breference%5D%28https%3A//github.com/better-auth/better-auth/issues/4611%29.%0A%0AIf%20you%20need%20session%20refresh%20with%20correct%20HTTP%20method%20routing%2C%20you%E2%80%99d%20need%20to%20implement%20a%20custom%20endpoint%20or%20middleware%20that%20performs%20the%20refresh%20logic%20via%20POST%2C%20but%20this%20isn%E2%80%99t%20supported%20out%20of%20the%20box%20and%20would%20require%20forking%20or%20wrapping%20the%20current%20implementation.%0A%0AA%20feature%20to%20allow%20configuring%20the%20HTTP%20method%20for%20session%20refresh%20would%20benefit%20users%20in%20environments%20with%20read/write%20separation%20and%20is%20a%20reasonable%20candidate%20for%20a%20future%20update.%20For%20now%2C%20disabling%20session%20refresh%20is%20the%20only%20reliable%20workaround.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6799)
GiteaMirror commented 2026-04-13 06:52:52 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Apr 1, 2026):

This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.

<!-- gh-comment-id:4166562048 --> @github-actions[bot] commented on GitHub (Apr 1, 2026): This issue has been locked as it was closed more than 7 days ago. If you're experiencing a similar problem or you have additional context, please open a new issue and reference this one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#10633