github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8273] ### Bug: signOut() does not clear session_data (cache) cookie #11042

New Issue
Open
opened 2026-04-13 07:25:12 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-13 07:25:12 -05:00
Owner
Copy Link

Originally created by @MartinIsProgramming on GitHub (Mar 2, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8273

Originally assigned to: @himself65 on GitHub.

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Configure Better Auth with cookieCache enabled: 
    session: {                                                                                                                          
  cookieCache: {                                                                                                                    
    enabled: true,                                                                                                                  
    maxAge: 30,                                                                                                                     
    strategy: "compact",                                                                                                            
  },                                                                                                                                
}
  2. Login as a user
  3. Call authClient.signOut()
  4. Manually navigate to a protected route (e.g., /dashboard)
  5. User can still access the protected route until maxAge (30 seconds) expires

Current vs. Expected behavior

Current vs. Expected behavior:

Current: After calling signOut(), the session_token cookie is cleared but the session_data cookie (cache) persists. This allows the user to access protected routes until the cache expires.

Expected: signOut() should clear BOTH cookies (session_token AND session_data) to ensure immediate session invalidation.

What version of Better Auth are you using?

1.4.18

System info

**System info:**                                                                                                                       
  - OS: macOS                                                                                                                            
  - Node: 22.x                                                                                                                           
  - Framework: Elysia (API) + React with TanStack Router (Client)                                                                        
  - Database: PostgreSQL with Drizzle ORM

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({                                                                                                       
    database: drizzleAdapter(db, { provider: "pg", schema }),                                                                            
    emailAndPassword: {                                                                                                                  
      enabled: true,                                                                                                                     
      requireEmailVerification: true,                                                                                                    
    },                                                                                                                                   
    session: {                                                                                                                           
      expiresIn: 60 * 60 * 24 * 7,                                                                                                       
      updateAge: 60 * 60 * 24,                                                                                                           
      storeSessionInDatabase: true,                                                                                                      
      cookieCache: {                                                                                                                     
        enabled: true,                                                                                                                   
        maxAge: 30,                                                                                                                      
        strategy: "compact",                                                                                                             
      },                                                                                                                                 
    },                                                                                                                                   
  });

Additional context

Tested locally on Chrome and Safari. The issue is reproducible 100% of the time.
Workaround: Disable cookieCache entirely with cookieCache: { enabled: false }.

Originally created by @MartinIsProgramming on GitHub (Mar 2, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8273 Originally assigned to: @himself65 on GitHub. ### Is this suited for github? - [ ] Yes, this is suited for github ### To Reproduce 1. Configure Better Auth with cookieCache enabled: ```typescript session: { cookieCache: { enabled: true, maxAge: 30, strategy: "compact", }, } 2. Login as a user 3. Call authClient.signOut() 4. Manually navigate to a protected route (e.g., /dashboard) 5. User can still access the protected route until maxAge (30 seconds) expires ### Current vs. Expected behavior **Current vs. Expected behavior:** Current: After calling signOut(), the session_token cookie is cleared but the session_data cookie (cache) persists. This allows the user to access protected routes until the cache expires. Expected: signOut() should clear BOTH cookies (session_token AND session_data) to ensure immediate session invalidation. ### What version of Better Auth are you using? 1.4.18 ### System info ```bash **System info:** - OS: macOS - Node: 22.x - Framework: Elysia (API) + React with TanStack Router (Client) - Database: PostgreSQL with Drizzle ORM ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ database: drizzleAdapter(db, { provider: "pg", schema }), emailAndPassword: { enabled: true, requireEmailVerification: true, }, session: { expiresIn: 60 * 60 * 24 * 7, updateAge: 60 * 60 * 24, storeSessionInDatabase: true, cookieCache: { enabled: true, maxAge: 30, strategy: "compact", }, }, }); ``` ### Additional context Tested locally on Chrome and Safari. The issue is reproducible 100% of the time. Workaround: Disable cookieCache entirely with `cookieCache: { enabled: false }`.
GiteaMirror added the coreneeds: infobug labels 2026-04-13 07:25:12 -05:00
GiteaMirror commented 2026-04-13 07:25:14 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 2, 2026):

Hi @MartinIsProgramming! I'm Dosu and I’m helping the better-auth team.

The signOut implementation does clear both session_token and session_data cookies in the deleteSessionCookie() function, so this might be an integration issue rather than a core bug.

Common causes for this behavior:

  1. Set-Cookie headers not forwarded – If you're using custom middleware or API routes with Elysia, the Set-Cookie headers from the /api/auth/sign-out response may not be reaching the browser. This is a known issue in custom integrations.

  2. Comma-joined Set-Cookie headers – There's a reported issue where multiple cookies get comma-joined into a single header instead of separate headers, causing browsers to only parse the first cookie.

Debugging steps:

  1. Check your browser's Network tab for the /api/auth/sign-out response – verify that Set-Cookie headers for both better-auth.session_token and better-auth.session_data are present with Max-Age=0
  2. If headers are missing, verify your Elysia middleware is properly forwarding all response headers

Quick workaround (besides disabling cookieCache):

// Manually clear the cookie on client-side after signOut
document.cookie = "better-auth.session_data=; Max-Age=0; path=/";

If the Set-Cookie headers are indeed present in the response but cookies aren't being cleared, that would point to a cookie attribute mismatch (path/domain/secure).

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3981712330 --> @dosubot[bot] commented on GitHub (Mar 2, 2026): <!-- Greeting --> Hi @MartinIsProgramming! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> The [signOut implementation does clear both `session_token` and `session_data` cookies](https://github.com/better-auth/better-auth/blob/e71b820c2d7f848609fa71ef9cebfb8e81c7d6ac/packages/better-auth/src/cookies/index.ts#L321-L357) in the `deleteSessionCookie()` function, so this might be an integration issue rather than a core bug. **Common causes for this behavior:** 1. **Set-Cookie headers not forwarded** – If you're using custom middleware or API routes with Elysia, the `Set-Cookie` headers from the `/api/auth/sign-out` response may not be reaching the browser. This is [a known issue](https://github.com/better-auth/better-auth/issues/6729#issuecomment-3649392062) in custom integrations. 2. **Comma-joined Set-Cookie headers** – There's a [reported issue](https://github.com/better-auth/better-auth/issues/7878) where multiple cookies get comma-joined into a single header instead of separate headers, causing browsers to only parse the first cookie. **Debugging steps:** 1. Check your browser's Network tab for the `/api/auth/sign-out` response – verify that `Set-Cookie` headers for both `better-auth.session_token` and `better-auth.session_data` are present with `Max-Age=0` 2. If headers are missing, verify your Elysia middleware is properly forwarding all response headers **Quick workaround** (besides disabling cookieCache): ```typescript // Manually clear the cookie on client-side after signOut document.cookie = "better-auth.session_data=; Max-Age=0; path=/"; ``` If the `Set-Cookie` headers are indeed present in the response but cookies aren't being cleared, that would point to a cookie attribute mismatch (path/domain/secure). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/201185b1-fb83-444a-a25a-d4f596ca5e37?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20%5BsignOut%20implementation%20does%20clear%20both%20%60session_token%60%20and%20%60session_data%60%20cookies%5D%28https%3A//github.com/better-auth/better-auth/blob/e71b820c2d7f848609fa71ef9cebfb8e81c7d6ac/packages/better-auth/src/cookies/index.ts%23L321-L357%29%20in%20the%20%60deleteSessionCookie%28%29%60%20function%2C%20so%20this%20might%20be%20an%20integration%20issue%20rather%20than%20a%20core%20bug.%0A%0A%2A%2ACommon%20causes%20for%20this%20behavior%3A%2A%2A%0A%0A1.%20%2A%2ASet-Cookie%20headers%20not%20forwarded%2A%2A%20%E2%80%93%20If%20you%27re%20using%20custom%20middleware%20or%20API%20routes%20with%20Elysia%2C%20the%20%60Set-Cookie%60%20headers%20from%20the%20%60/api/auth/sign-out%60%20response%20may%20not%20be%20reaching%20the%20browser.%20This%20is%20%5Ba%20known%20issue%5D%28https%3A//github.com/better-auth/better-auth/issues/6729%23issuecomment-3649392062%29%20in%20custom%20integrations.%0A%0A2.%20%2A%2AComma-joined%20Set-Cookie%20headers%2A%2A%20%E2%80%93%20There%27s%20a%20%5Breported%20issue%5D%28https%3A//github.com/better-auth/better-auth/issues/7878%29%20where%20multiple%20cookies%20get%20comma-joined%20into%20a%20single%20header%20instead%20of%20separate%20headers%2C%20causing%20browsers%20to%20only%20parse%20the%20first%20cookie.%0A%0A%2A%2ADebugging%20steps%3A%2A%2A%0A1.%20Check%20your%20browser%27s%20Network%20tab%20for%20the%20%60/api/auth/sign-out%60%20response%20%E2%80%93%20verify%20that%20%60Set-Cookie%60%20headers%20for%20both%20%60better-auth.session_token%60%20and%20%60better-auth.session_data%60%20are%20present%20with%20%60Max-Age%3D0%60%0A2.%20If%20headers%20are%20missing%2C%20verify%20your%20Elysia%20middleware%20is%20properly%20forwarding%20all%20response%20headers%0A%0A%2A%2AQuick%20workaround%2A%2A%20%28besides%20disabling%20cookieCache%29%3A%0A%60%60%60typescript%0A//%20Manually%20clear%20the%20cookie%20on%20client-side%20after%20signOut%0Adocument.cookie%20%3D%20%22better-auth.session_data%3D%3B%20Max-Age%3D0%3B%20path%3D/%22%3B%0A%60%60%60%0A%0AIf%20the%20%60Set-Cookie%60%20headers%20are%20indeed%20present%20in%20the%20response%20but%20cookies%20aren%27t%20being%20cleared%2C%20that%20would%20point%20to%20a%20cookie%20attribute%20mismatch%20%28path/domain/secure%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8273)
GiteaMirror commented 2026-04-13 07:25:15 -05:00
Author
Owner
Copy Link

@himself65 commented on GitHub (Mar 2, 2026):

Are you seeing this in 1.5?

<!-- gh-comment-id:3982158494 --> @himself65 commented on GitHub (Mar 2, 2026): Are you seeing this in 1.5?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug core needs: info
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#11042
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?